What Happened
Adobe released patches addressing eleven vulnerabilities across ColdFusion and Campaign Classic, seven carrying the maximum CVSS score of 10.0. The ColdFusion flaws, including CVE-2026-48276, CVE-2026-48277, CVE-2026-48281, CVE-2026-48282, CVE-2026-48283, and CVE-2026-48316, stem from unrestricted upload of dangerous file types, improper input validation, and path traversal weaknesses, affecting ColdFusion 2025 Update 9 and earlier, and ColdFusion 2023 Update 20 and earlier. A separate Campaign Classic flaw, CVE-2026-48286, involves incorrect authorization and also allows arbitrary code execution.
Adobe describes the vulnerabilities as exploitable in low-complexity attacks requiring no user interaction. Fixes ship in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21. Adobe reports no active exploitation at disclosure, though maximum severity combined with low attack complexity makes rapid weaponization likely.
Why This Matters for Canadian Organizations
ColdFusion has a long history in Canadian government, education, and enterprise web applications, particularly legacy systems built years ago and left running with minimal ongoing maintenance. Unauthenticated remote code execution against internet-facing ColdFusion servers gives attackers a direct path into internal networks, and organizations running ColdFusion for older applications often lack the patch cadence applied to newer platforms.
Campaign Classic customers, often marketing and communications teams, sit outside a security team’s regular vulnerability scanning scope in many organizations, creating a second blind spot. Under OSFI B-13 guidelines and PIPEDA obligations, Canadian organizations bear responsibility for patching known vulnerabilities in systems handling personal or operational data, regardless of which internal team manages the platform.
What to Do
Inventory every internet-facing ColdFusion and Campaign Classic instance across your organization, including systems managed outside the core IT security team. Apply ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21, and confirm Campaign Classic instances receive the CVE-2026-48286 fix. Where immediate patching is not possible, restrict network access to ColdFusion administration interfaces and file upload endpoints until updates are complete.
Read the full report at BleepingComputer.
