CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Adobe ColdFusion

product · product:adobe-coldfusion single-source

Coverage
2
first 2026-08-28 → last 2026-10-16
Latest activity
2026-10-16
Adobe fixes unauthenticated CVSS 10.0 flaws in ColdFusion, Experience Manager and Commerce; no exploitation…
Peak priority
high
1 high · 1 notable
Targets
technology
sectors: technology, public-sector · regions: europe
Sources cited
6
3 hosts

Action items (3)

Do-now tasks recorded on the entries about Adobe ColdFusion, newest first. Check the date before acting on an older one.

  • Update every internet-facing ColdFusion server to 2025.0.14 or 2023.0.26, every AEM instance to Cloud Service 2026.9.28386 or the per-issue hotfixes for 6.5 Service Pack 25 and 6.5 LTS Service Pack 3, and Adobe Commerce and Magento Open Source to the 2026-oct build of the installed 2.4.x line (together with the CVE-2026-75650 hotfix from the September APSB26-146 update where it is missing); on a Composer-installed Commerce or Magento store apply the 2026-oct release or Adobe's isolated patch explicitly, because the base version stays vulnerable; Magento Open Source 2.4.6 has no listed fix.
    2026-10-14CVE-2026-105899 +9
  • Patch internet-facing ColdFusion 2025/2023 instances to 2025.0.12 / 2023.0.23 now; CVE-2026-48362 is an unauthenticated OS command injection at CVSS 10.0, the class of flaw that gets weaponised within days of a patch diff being published, and Adobe reports no exploitation yet, which is the window to close before one exists.
    2026-08-28CVE-2026-48362 +5
  • For any on-premise or hybrid Adobe Campaign Classic ACC v7 deployment, upgrade to 7.4.4 build 9400 now, two of the three fixed flaws (CVE-2026-71398, CVE-2026-27302) are unauthenticated CVSS 10.0 code-execution paths; Adobe-hosted instances are already remediated and need no action.
    2026-08-28CVE-2026-48362 +5

Defender insights

What each entry about Adobe ColdFusion tells a defender to do, newest first.

2026-10-14NOTABLEAdobe fixes unauthenticated CVSS 10.0 flaws in ColdFusion, Experience Manager and Commerce; no exploitation known

Exposure · detection

Story timeline

  1. 2026-10-14Adobe October 2026 bulletins: unauthenticated CVSS 9.0 to 10.0 flaws, most leading to code execution, in ColdFusion (APSB26-144), Experience Manager (APSB26-152) and Commerce and Magento (APSB26-153), none reported exploited
    trending-vulnerabilitiesAdobe fixes unauthenticated CVSS 10.0 flaws in ColdFusion, Experience Manager and Commerce; no exploitation known
  2. 2026-08-28Adobe August 2026 Patch Day: ColdFusion ships a CVSS 10.0 unauthenticated OS command injection, and Campaign Classic ships two more unauthenticated CVSS 10.0 flaws in the same release
    trending-vulnerabilitiesAdobe's August bulletins carry three separate unauthenticated, maximum-severity code-execution flaws across ColdFusion and Campaign Classic

Hunting pivots

CVEs
CVE-2026-103849CVE-2026-105899CVE-2026-106619CVE-2026-106621CVE-2026-106622CVE-2026-106624CVE-2026-27302CVE-2026-48273CVE-2026-48362CVE-2026-48381CVE-2026-48382CVE-2026-48383CVE-2026-71384CVE-2026-71398CVE-2026-90532CVE-2026-92909
Releases covered
Adobe ColdFusionAdobe ColdFusion 2023Adobe ColdFusion 2025
Tags
patch-available ×2pre-auth ×2rce ×2vulnerabilities ×2auth-bypass
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 2 entries about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×2

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-14/adobe-october-2026-coldfusion-aem-commerce-unauth-critical · 2026-08-28/adobe-august-2026-coldfusion-campaign-classic-cvss10 · ATT&CK page ↗

Entries about Adobe ColdFusion (2)

2026-10-14 · view entry permalink →

NOTABLECVE-2026-105899 +9updatedNATOA2

Adobe October 2026 bulletins: unauthenticated CVSS 9.0 to 10.0 flaws, most leading to code execution, in ColdFusion (APSB26-144), Experience Manager (APSB26-152) and Commerce and Magento (APSB26-153), none reported exploited

Adobe's 2026-10-13 bulletins put critical fixes into three server products: ColdFusion, Experience Manager and Commerce. Adobe says it is not aware of any exploits in the wild for the ColdFusion issues (Adobe ColdFusion APSB26-144, 2026-10-13). ColdFusion 2025 up to 2025.0.13 and 2023 up to 2023.0.25 are affected and 2025.0.14 and 2023.0.26 fix them; the bulletin lists five network flaws that need no privileges at CVSS 9.0 or above: an unrestricted file upload leading to arbitrary code execution (CVE-2026-105899, 10.0), a server-side request forgery rated privilege escalation (CVE-2026-106622, 10.0), an input-validation flaw leading to code execution (CVE-2026-106624, 9.8), a code injection rated privilege escalation (CVE-2026-106621, 9.1) and a further input-validation code-execution flaw (CVE-2026-106619, 9.0, high complexity), besides code-execution flaws that need a low-privileged account at 9.9 (Adobe ColdFusion APSB26-144, 2026-10-13).

Experience Manager APSB26-152 covers Cloud Service 2026.9.28187 and earlier, 6.5 up to Service Pack 25 and 6.5 LTS up to Service Pack 3: three incorrect-authorization flaws that lead to arbitrary code execution are scored 10.0 with no privileges required (CVE-2026-90532, CVE-2026-48383, CVE-2026-48382), fixed by Cloud Service 2026.9.28386 and, on 6.5 and 6.5 LTS, by per-issue hotfixes, and Adobe is not aware of exploits of these either (Adobe Experience Manager APSB26-152, 2026-10-13). Commerce and Magento APSB26-153 fixes a template-engine injection leading to code execution (CVE-2026-103849, 10.0, which Adobe marks as needing no authentication) and an incorrect-authorization code-execution flaw (CVE-2026-92909, 9.8, which Adobe's note tags B2B) in builds up to the 2026-sep release; the fixes are the 2026-oct builds, Adobe Commerce B2B has its own 2026-oct builds, Magento Open Source gets them for 2.4.9, 2.4.8 and 2.4.7, and Adobe asks customers to apply the CVE-2026-75650 hotfix from its September APSB26-146 update as well, and Adobe is likewise not aware of exploits (Adobe Commerce APSB26-153, 2026-10-13).

But we managed to reproduce four different attack routes within 24 hours, and expect threat actors to do the same.

A plain Composer install still has the vulnerable base version

Sansec 2026-10-15
Updaterun 2026-10-16T0256Z-intelsummarysourcesevidenceverificationsourcing_noteactionsbody

Sansec reports that it reproduced four different attack routes to code execution for the Commerce and Magento template-engine flaw CVE-2026-103849 within 24 hours of Adobe's fix and expects threat actors to do the same, and that it has not seen attacks on live stores (Sansec, 2026-10-15). It describes the flaw as a second-pass directive injection like September's StyleSmuggler, where attacker-controlled data in a child template can still be signed and re-scanned at the root level so that a smuggled block directive runs inside Magento's rendering, and says Adobe's October patch replaces that generic re-scan with registered placeholders (Sansec, 2026-10-15). Sansec questions Adobe's priority 2 rating for the Commerce bulletin, a 30-day patch window, because StyleSmuggler went from a priority 1 hotfix to mass exploitation in three days and it judges BlockStrap to be of similar complexity (Sansec, 2026-10-15).

Two cautions for the patch: a plain Composer install still has the vulnerable base version, so the 2026-oct release or Adobe's isolated patch must be applied, and BlockStrap and StyleSmuggler are separate fixes, so the September hotfix for CVE-2026-75650 has to stay in place as well (Sansec, 2026-10-15). Sansec lists Adobe Commerce up to 2.4.9, Adobe Commerce B2B up to 1.5.3 and Magento Open Source up to 2.4.9 as affected (Sansec, 2026-10-15).

Builds on: Adobe's August bulletins carry three separate unauthenticated, maximum-severity code-execution… · Adobe rates its own emergency hotfix priority 1 for a flaw stores were already being…

vulnerability14 Oct 03:41Zmulti-sourceOpen finding →
Sources: Adobe · Sansec

2026-08-28 · view entry permalink →

HIGHCVE-2026-48362 +5NATOA2

Adobe August 2026 Patch Day: ColdFusion ships a CVSS 10.0 unauthenticated OS command injection, and Campaign Classic ships two more unauthenticated CVSS 10.0 flaws in the same release

Adobe's 2026-08-11 Security Patch Day carries two bulletins whose headline flaws are unauthenticated, no-interaction paths to arbitrary code execution at CVSS 10.0. APSB26-90 fixes 16 CVEs in ColdFusion 2025 (≤2025.0.11) and 2023 (≤2023.0.22), led by CVE-2026-48362 (CWE-78, OS command injection, CVSS 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) (unauthenticated arbitrary code execution) and CVE-2026-48273 (CWE-95, eval injection, 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), which needs low-privileged access rather than none (Adobe, APSB26-90, 2026-08-11). The remaining fourteen span incorrect-authorization application denial-of-service (CVE-2026-71384, 9.6), cross-site scripting escalating to code execution (CVE-2026-71386, 8.8), privilege escalation via input validation (CVE-2026-21273, 8.7), further authorization and hard-coded-key defects down to CVSS 4.9, and a heap-based buffer overflow (CVE-2026-48440, 8.1). Adobe states it is "not aware of any exploits in the wild for any of the issues addressed in this update," and separately recommends keeping the underlying JDK/JRE current and reviewing its serialFilter guidance for insecure deserialization (Adobe, APSB26-90, 2026-08-11).

APSB26-123 covers Adobe Campaign Classic, explicitly scoped to on-premise deployments and the on-premise leg of hybrid deployments, since "Adobe-hosted instances have already been remediated and require no customer action" (Adobe, APSB26-123, 2026-08-11). Two of its three fixed CVEs are unauthenticated CVSS 10.0 incorrect-authorization flaws reaching arbitrary code execution (CVE-2026-71398 and CVE-2026-27302, the same vector under two identifiers) and the third, CVE-2026-48381 (CWE-89, SQL injection, 9.0, AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), is unauthenticated with high attack complexity. All three are fixed in ACC v7 7.4.4 build 9400 for both Windows and Linux; the earlier 7.4.3 build 9399 and prior are affected. No exploitation is reported for either bulletin, and neither Adobe advisory names a researcher, which is consistent with an internally-found batch.

Detection, in vendor-neutral terms: ColdFusion's command-injection path and Campaign Classic's authorization flaws both reach the underlying host or database with no prior authentication, so the durable telemetry is process-lineage and query-shape anomalies rather than an authentication event, a ColdFusion application-server process spawning an OS shell or interpreter with no corresponding administrative session, and Campaign Classic database queries or file operations issued outside the product's own scheduled and interactive-session patterns. Because no public proof-of-concept or exploitation report exists yet for either bulletin, the defensible position is to treat the patch window itself as the exposure window and close it before a diff-derived exploit appears, rather than waiting for confirmed activity.

Adobe has released a security update for ColdFusion versions 2025 and 2023. This update resolves critical and important vulnerabilities that could result in arbitrary code execution, privilege escalation, security feature bypass, application denial-of-service, and memory exposure.

Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.

Adobe (APSB26-90) 2026-08-11

This security bulletin applies only to fully on-premise deployments of Adobe Campaign Classic and to the on-premise components of hybrid deployments. Adobe-hosted instances have already been remediated and require no customer action.

Adobe (APSB26-123) 2026-08-11
vulnerability28 Aug 05:15Zsingle-sourceOpen finding →
Sources: Adobe (APSB26-90) · Adobe (APSB26-123)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns2

Source distribution

  • adobe.com3 (50%)
  • helpx.adobe.com2 (33%)
  • sansec.io1 (17%)
All cited sources (6)