Adobe ColdFusion/Campaign APSB26-68/69

Adobe Campaign Classic APSB26-120, three more unauthenticated CVSS 10.0 code-execution flaws, and last week's build 9398 is the version they affect

Five days after Adobe fixed two critical unauthenticated flaws in Campaign Classic with build 9398, APSB26-114, dated 2026-07-29, also a Priority 1 update (Adobe PSIRT, 2026-07-29), it published a second bulletin whose affected range includes build 9398. APSB26-120, dated 2026-08-03, covers seven vulnerabilities in the on-premise campaign-management platform and records the affected versions as "ACC v7: 7.4.3 build 9398 and earlier", fixed in ACC v7 7.4.3 build 9399, at Adobe's highest priority rating of 1 (Adobe PSIRT, 2026-08-03). Any operator who treated last week's build as the end state (which is what the previous advisory called for) is still carrying every flaw below.

Three of the seven need no authentication and no user interaction, each scored CVSS 10.0 with changed scope (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and each independently sufficient for arbitrary code execution per Adobe's own impact column: CVE-2026-48331, a server-side request forgery (CWE-918); CVE-2026-48323, improper neutralization of special elements used in a template engine (CWE-1336); and CVE-2026-48330, a SQL injection (CWE-89). Four more carry a precondition: CVE-2026-48326 (CVSS 9.9) is a second SQL injection reaching code execution but requiring low privileges; CVE-2026-48333 (CVSS 9.8) is an incorrect-authorization flaw (CWE-863) giving unauthenticated privilege escalation; CVE-2026-48317 (CVSS 9.6) is an eval injection (CWE-95) needing low privileges; and CVE-2026-48399 (CVSS 7.5) is a violation of secure design principles (CWE-657) yielding a security-feature bypass. Adobe rates all seven Critical and states that it "is not aware of any exploits in the wild for any of the issues addressed in these updates" (Adobe PSIRT, 2026-08-03). NCSC-NL relayed the bulletin on 2026-08-06 and is explicit that it is not an update of its own earlier Campaign Classic advisory but a separate set of newly found vulnerabilities (NCSC-NL, 2026-08-06).

Exposure is a question of who runs their own instance: the bulletin "applies only to fully on-premise deployments of Adobe Campaign Classic and to the on-premise components of hybrid deployments", with Adobe-hosted instances already remediated and needing no customer action (Adobe PSIRT, 2026-08-03). This is the third distinct wave of critical unauthenticated code-execution-class disclosures against this product line since late June (Adobe PSIRT, 2026-07-29), each at Adobe's top priority, which is itself the planning signal, a platform producing pre-auth CVSS-10.0 flaws on a roughly weekly cadence is one to move off the public internet rather than one to keep patching in place. Detection concepts, telemetry class first: with no public proof-of-concept and no reported exploitation, version state is the only reliable check, so inventory on-premise ACC instances against build 9399 rather than waiting for exploitation telemetry; where the application server's outbound traffic is logged, unexpected egress initiated by the ACC process is the observable class the SSRF would produce, and unexpected child processes spawned by the web or template-rendering service is what the template-injection and eval-injection paths would produce. Both are behavioural classes derived from the flaw types Adobe names, not from any reported intrusion, no cited source describes an actual attack against these CVEs, so nothing here should be read as a hunt for known activity. One bookkeeping change worth noting for anyone who tracks Adobe CVE counts: the bulletin states that effective 2026-08-11, Adobe may assign a single CVE identifier to internally discovered vulnerabilities sharing a severity rating and CWE category when a release includes systemic fixes, so future counts will understate flaw counts relative to this one.

CVE-2026-48276, -48277, -48281, -48282, -48283, -48316, Adobe ColdFusion: six CVSS 10.0 unauthenticated RCE paths

Adobe's 2026-06-30 bulletin APSB26-68 fixes six maximum-severity (CVSS 10.0) remote-code-execution flaws in ColdFusion 2025 (≤ Update 9) and 2023 (≤ Update 20): two CWE-434 unrestricted-file-upload paths (CVE-2026-48276, CVE-2026-48283), three CWE-20 improper-input-validation paths (CVE-2026-48277, CVE-2026-48281, CVE-2026-48316) and one CWE-22 path-traversal path (CVE-2026-48282). All are network-exploitable with no authentication and no user interaction (AV:N/AC:L), and every fix is rated Adobe Priority 1 ("high risk of being targeted"); Adobe states it is "not aware of any exploits in the wild for any of the issues addressed in these updates" (Adobe PSIRT APSB26-68, 2026-06-30). A parallel same-day bulletin, APSB26-69, fixes a CVSS 10.0 CWE-863 incorrect-authorization code-execution flaw (CVE-2026-48286) in on-prem Campaign Classic 7.4.3 build 9396 and earlier, resolved in build 9397; Adobe-hosted instances were remediated server-side (Adobe PSIRT APSB26-69, 2026-06-30). ColdFusion's history of rapid weaponisation of unauth file-upload / path-traversal primitives makes this a same-week patch priority for any internet-facing instance even absent confirmed exploitation. Fixed in ColdFusion 2025 Update 10 and 2023 Update 21; given the unauthenticated file-upload class, review upload directories (cf_scripts, CFIDE, admin upload paths) for newly written .jsp/.cfm/.cfc files outside deployment windows (Adobe PSIRT APSB26-68, 2026-06-30).