Adobe — Critical CVSS 10.0 Flaws Patched in ColdFusion, Campaign Classic, and Adobe Commerce (CVE-2026-48362, CVE-2026-71398, CVE-2026-27302, CVE-2026-48449)

Publication date: August 12, 2026
Category: Vulnerability / Web Security

Introduction

Adobe has released its monthly cycle of security updates to address multiple critical vulnerabilities impacting core enterprise platforms, including ColdFusion, Adobe Commerce, Magento Open Source, and Adobe Campaign Classic. Among the patched flaws are multiple maximum-severity CVSS 10.0 vulnerabilities capable of facilitating arbitrary code execution and privilege escalation without requiring user interaction. Additionally, threat intelligence reports from Sansec have confirmed active exploitation attempts in the wild targeting an incorrect authorization flaw in Adobe Commerce (CVE-2026-71362), prompting system administrators to prioritize patch deployments within a 72-hour window.

What is the Affected Product Ecosystem? (General Analysis)

The enterprise applications evaluated in this security advisory represent vital infrastructure components across global corporate environments. Adobe ColdFusion serves as a rapid application development framework; Adobe Campaign Classic manages large-scale multichannel marketing campaigns; and Adobe Commerce (built on Magento) powers the transaction infrastructure for thousands of e-commerce organizations.

The coexistence of multiple CVSS 10.0 and high-severity vectors constitutes a severe systemic risk. Threat actors capable of exploiting these defects can achieve full control over underlying servers, compromise customer databases, manipulate active sessions, and deploy persistent malicious payloads.

Below is a summary of the vulnerabilities and their official reported parameters:

• CVE-2026-48362: OS Command Injection in ColdFusion. [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — 10.0 (CRITICAL)] / CWE-78 (NVD Verified).
• CVE-2026-48273: Eval injection vulnerability in ColdFusion leading to arbitrary code execution. [Estimated CVSS: 9.9] / CWE-94 (Reasoned Estimation).
• CVE-2026-71384: Incorrect authorization in ColdFusion leading to application Denial of Service (DoS). [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — 9.6 (CRITICAL)] / CWE-863 (NVD Verified).
• CVE-2026-71362: Incorrect authorization in Adobe Commerce leading to privilege escalation and session takeover. [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N — 9.1 (CRITICAL)] / CWE-863 (NVD Verified).
• CVE-2026-71398: Incorrect authorization in Adobe Campaign Classic leading to arbitrary code execution. [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — 10.0 (CRITICAL)] / CWE-863 (NVD Verified).
• CVE-2026-27302: Incorrect authorization in Adobe Campaign Classic leading to arbitrary code execution. [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — 10.0 (CRITICAL)] / CWE-863 (NVD Verified).
• CVE-2026-48381: SQL Injection vulnerability in Adobe Campaign Classic leading to arbitrary code execution. [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H — 9.0 (CRITICAL)] / CWE-89 (NVD Verified).
• CVE-2026-48449: Incorrect authorization in Adobe Campaign Classic (patched previously in the August cycle) with critical code execution impact. [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — 10.0 (CRITICAL)] / CWE-863 (NVD Verified).

How Does It Work? (Technical Analysis)

An analysis of the attack vectors highlights structural weaknesses in input validation and access control enforcement within backend application logic:

• Command and Code Injection Flow (ColdFusion): In CVE-2026-48362, the application fails to properly neutralize special elements utilized in OS commands (CWE-78). A remote attacker can transmit crafted HTTP requests that are unsafely concatenated into underlying server system calls, achieving code execution under the context of the application user with changed scope (S:C). Similarly, CVE-2026-48273 involves insecure evaluation of dynamic inputs, leading to arbitrary script statement execution.
• Authorization Flaws and Active Exploitation (Commerce and Campaign Classic): Incorrect authorization vulnerabilities (CVE-2026-71362, CVE-2026-71398, CVE-2026-27302) stem from flawed access control checks across critical API routes or admin panels. According to Sansec’s research on CVE-2026-71362, the flaw allows malicious network actors to arbitrarily switch a legitimate customer’s session to another customer account (account takeover), granting unauthenticated access to private and sensitive data.
• SQL Injection and Persistence (Campaign Classic): CVE-2026-48381 exploits improper input sanitization in database queries (CWE-89), which under specific conditions enables execution flow manipulation and operating system-level command execution on on-premise deployments.

Affected Systems / Environments

The vulnerabilities directly impact the following software architectures and versions:

• ColdFusion: Vulnerable versions prior to 2025.0.12 and 2023.0.23.
• Adobe Commerce / Magento Open Source: Instances exposed to session manipulation vectors (CVE-2026-71362).
• Adobe Campaign Classic: Versions prior to ACC v7 7.4.4 build 9400 (affecting exclusively fully on-premise deployments or on-premise components of hybrid architectures; Adobe-hosted cloud instances have already been remediated).

Criticality Notice: Updates issued for ColdFusion and Campaign Classic carry a Priority 1 rating, indicating a heightened risk of active exploitation by malicious threat actors.

Mitigation and Detection

Remediation

1. Immediate Patch Deployment: Update ColdFusion to versions 2025.0.12 and 2023.0.23 (or higher). Update Adobe Campaign Classic to version ACC v7 7.4.4 build 9400.
2. Adobe Commerce Review: Apply official security patches corresponding to Magento/Commerce to neutralize session hijacking vectors.
3. Network Restriction and Segmentation: Isolate local ColdFusion and Campaign Classic servers, ensuring they are not directly exposed to the internet without a hardened reverse proxy or WAF enforcing strict command and SQL inspection rules.

Detection

Defensive security teams (Blue Teams) should actively monitor access and application logs for anomalous patterns:

• Inspect web access logs for unusual HTTP requests containing command escape characters (&, |, ;, eval()) directed toward ColdFusion endpoints.
• Monitor unexpected changes in user sessions and unauthorized concurrent access attempts across Adobe Commerce platforms.

# Basic heuristic pattern for detecting injection attempts in HTTP requests
GET /.*\?(.*(cmd|exec|eval|system|bash|sh)=.*) HTTP/1.1

Operational Note: Given that active exploitation attempts have been reported for e-commerce authorization flaws, reviewing authentication logs from the past 72 hours is mandatory to rule out prior compromise.

Wrapping Up

Adobe’s recent patch deployment exposes the persistent fragility inherent in complex corporate web applications. With multiple vulnerabilities rated at a critical score of 10.0 and evidence of active exploitation in the wild for Adobe Commerce, organizations operating ColdFusion, Campaign Classic, or Commerce must act with utmost urgency. Applying updates within the recommended 72-hour window is indispensable to prevent server takeover and massive exfiltration of corporate and customer data.

References

• The Hacker News. (2026). Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws. Retrieved from https://thehackernews.com/2026/08/adobe-patches-three-cvss-10-0-coldfusion-and-campaign-classic-flaws.html
• Adobe Inc. Adobe Security Advisories and Bulletins. Retrieved from https://helpx.adobe.com/security.html
• Adobe Inc. APSByyyy-xx ColdFusion Advisory (CVE-2026-48362). Retrieved from https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html
• Adobe Inc. APSByyyy-xx Magento/Commerce Advisory (CVE-2026-71362). Retrieved from https://helpx.adobe.com/security/products/magento/apsb26-92.html
• Adobe Inc. APSByyyy-xx Campaign Advisory (CVE-2026-71398). Retrieved from https://helpx.adobe.com/security/products/campaign/apsb26-123.html
• Adobe Inc. Priority 1 Security Ratings. Retrieved from https://helpx.adobe.com/security/severity-ratings.html
• Sansec Threat Research. (2026). Adobe Commerce Account Takeover Vulnerability (APSB26-92). Retrieved from https://sansec.io/research/adobe-commerce-account-takeover-apsb26-92