Adobe Patches Critical Flaws in ColdFusion, Commerce, and Campaign Classic

Adobe has released updates to address multiple critical security vulnerabilities in ColdFusion, Commerce, and Campaign Classic. The patches aim to fix flaws that could result in arbitrary code execution and privilege escalation if successfully exploited. The most severe of the flaws include CVE-2026-48362 and CVE-2026-71398, both with a CVSS score of 10.0. These vulnerabilities affect ColdFusion and Campaign Classic, respectively, and could lead to arbitrary code execution. Additionally, CVE-2026-48273 and CVE-2026-71384 have a CVSS score of 9.9 and 9.6, respectively. These flaws also affect ColdFusion and could lead to arbitrary code execution and application denial-of-service. In Commerce, CVE-2026-71362 has a CVSS score of 9.1 and could lead to privilege escalation. This flaw has already been exploited in the wild, according to Sansec, a Dutch e-commerce security company. Sansec claims that the vulnerability in Adobe Commerce and Magento Open Source allows attackers to switch a customer session to another customer account, giving them access to the victim's account and private customer data. The updates for ColdFusion and Campaign Classic have a Priority 1 rating, indicating a higher risk of being targeted by malicious cyber attacks. However, the Campaign Classic updates only apply to fully on-premise deployments and to the on-premise components of hybrid deployments. Adobe-hosted instances have already been remediated and require no customer action. Although there is no evidence of these flaws being exploited in the wild, administrators are recommended to install the update as soon as possible, preferably within 72 hours. This is especially important given the recent disclosure of a maximum-severity security flaw in Campaign Classic (CVE-2026-48449, CVSS score: 10.0) that could result in arbitrary code execution. It is essential for administrators to stay vigilant and install the updates promptly to prevent potential attacks. The updates are available for download, and administrators are recommended to follow the instructions provided by Adobe to ensure a smooth installation process.