Adobe — Critical Remote Code Execution and Authorization Vulnerabilities Patched in ColdFusion and Campaign Classic (CVE-2026-48362, CVE-2026-71398, and Others)
Publication date: August 12, 2026
Category: Vulnerability / Web Security
Introduction
Adobe has released an emergency set of security updates to mitigate multiple critical vulnerabilities impacting essential enterprise platforms, including Adobe ColdFusion, Adobe Commerce (Magento), and Adobe Campaign Classic. Among the addressed flaws are several vulnerabilities carrying a maximum CVSS v3.1 score of 10.0, which enable unauthenticated remote code execution without requiring user interaction. The urgency of these updates is amplified by threat intelligence reports indicating active exploitation in production environments for at least one vector in Adobe Commerce.
What is the Affected Attack Surface? (General Analysis)
Adobe’s enterprise software stack integrates complex server-side processing logic, template engines, and advanced database and marketing campaign management systems. Due to their widespread deployment in critical corporate infrastructures and internet-facing networks, these solutions represent high-value targets for malicious actors seeking data theft and account takeover vectors.
The maximum-severity flaws involve weaknesses in process isolation and access control, allowing external attackers to manipulate operating system commands, bypass authorization mechanisms, or execute malicious queries directly on the backend.
Official metrics verified by the National Vulnerability Database (NVD) are detailed below:
| CVE | Category (CWE) | Impact | CVSS | Vector (CVSS v3.1) |
|---|---|---|---|---|
| CVE-2026-48362 | CWE-78 (OS Command Injection) | Code Execution | 10.0 (Critical) | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (NVD Verified) |
| CVE-2026-48273 | CWE-94 or similar (Eval Injection) | Code Execution | 9.9 (Critical) | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (Reasoned Estimate) |
| CVE-2026-71384 | CWE-863 (Incorrect Authorization) | Denial of Service / Bypass | 9.6 (Critical) | AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (NVD Verified) |
| CVE-2026-71362 | CWE-863 (Incorrect Authorization) | Privilege Escalation | 9.1 (Critical) | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (NVD Verified) |
| CVE-2026-71398 | CWE-863 (Incorrect Authorization) | Code Execution | 10.0 (Critical) | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (NVD Verified) |
| CVE-2026-27302 | CWE-863 (Incorrect Authorization) | Code Execution | 10.0 (Critical) | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (NVD Verified) |
| CVE-2026-48381 | CWE-89 (SQL Injection) | Code Execution | 9.0 (Critical) | AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H (NVD Verified) |
| CVE-2026-48449 | CWE-863 (Incorrect Authorization) | Code Execution | 10.0 (Critical) | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (NVD Verified) |
How Does It Work? (Technical Analysis)
An analysis of the exploitation vectors exposes fundamental architectural flaws in input validation and privilege management:
- Command Injection and Code Evaluation (ColdFusion): In vulnerabilities such as
CVE-2026-48362(CWE-78), the ColdFusion engine processes untrusted user input without properly neutralizing special characters. This allows attackers to concatenate arbitrary commands that execute directly within the context of the operating system user running the service. Similarly, the eval injection flaw (CVE-2026-48273) permits the evaluation of malicious dynamic expressions. - Authorization Bypass and Session Takeover (Adobe Commerce): Security researchers at Sansec identified that vulnerability
CVE-2026-71362(CWE-863) is actively exploited to switch a customer session context and link it to an alternate account. Through this authorization flaw, attackers gain full access to private customer data without requiring valid credentials. - Authorization Flaws and Execution in Campaign Classic: Vulnerabilities in Adobe Campaign Classic (
CVE-2026-71398,CVE-2026-27302,CVE-2026-48449) combine incorrect access control with the ability to modify the security scope (Scope: Changed), allowing unauthenticated requests to escalate privileges up to arbitrary code execution. Additionally,CVE-2026-48381introduces an SQL injection vector (CWE-89) facilitating indirect command execution under specific system conditions.
Affected Systems / Environments
The security updates released by Adobe directly impact the following software products and versions:
- Adobe ColdFusion: Versions prior to 2025.0.12 and 2023.0.23 (affected by
CVE-2026-48362,CVE-2026-48273,CVE-2026-71384). - Adobe Commerce and Magento Open Source: Impacted by authorization flaws such as
CVE-2026-71362. - Adobe Campaign Classic (ACC): Versions prior to ACC v7 7.4.4 build 9400. Critical Note: Campaign Classic updates apply exclusively to fully on-premise deployments and on-premise components of hybrid deployments (Adobe-hosted instances have already been remediated centrally).
Mitigation and Detection
Remediation
- Priority Patch Deployment: System administrators are strongly advised to apply the official updates provided in Adobe’s security bulletins within a 72-hour window.
- Priority Rating: These updates carry a Priority 1 rating, indicating an elevated risk of active targeting by malicious cyber attackers.
- Network Isolation: For internal components or ColdFusion environments, ensure that administrative console access is restricted strictly to trusted management networks to mitigate adjacent network vectors (
CVE-2026-71384).
Detection
- Log Monitoring: Actively review access and application logs for anomalous user session alteration patterns in Adobe Commerce, as well as suspicious HTTP requests containing operating system command sequences or SQL injections in ColdFusion and Campaign Classic.
- Threat Intelligence: Monitor infrastructure for indicators of compromise related to account takeover and unexpected secondary process execution stemming from Adobe web services.
“Active exploitation detected in e-commerce components emphasizes the need to treat incorrect authorization flaws with the exact same operational urgency as pure remote code execution.”
Wrapping Up
Adobe’s recent security advisory cycle highlights the critical importance of keeping internet-facing corporate platforms up to date. With multiple vulnerabilities rated at CVSS 10.0 and concrete evidence of in-the-wild exploitation within the Commerce ecosystem, organizations must prioritize immediate patch deployment and audit their logs for potential prior unauthorized access.
References
- The Hacker News. (2026). Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws. Retrieved from https://thehackernews.com/2026/08/adobe-patches-three-cvss-10-0-coldfusion-and-campaign-classic-flaws.html
- Adobe Inc. (2026). Security Updates Available for Adobe ColdFusion (APSB26-90). Retrieved from https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html
- Adobe Inc. (2026). Security Updates Available for Adobe Commerce (APSB26-92). Retrieved from https://helpx.adobe.com/security/products/magento/apsb26-92.html
- Adobe Inc. (2026). Security Updates Available for Adobe Campaign Classic (APSB26-123 / APSB26-114). Retrieved from https://helpx.adobe.com/security/products/campaign/apsb26-123.html
- Sansec. (2026). Adobe Commerce Account Takeover Vulnerability Analysis. Retrieved from https://sansec.io/research/adobe-commerce-account-takeover-apsb26-92
- CISA / NVD. (2026). Official Vulnerability Records for CVE-2026-48362, CVE-2026-71384, CVE-2026-71362, CVE-2026-71398, CVE-2026-27302, CVE-2026-48381, and CVE-2026-48449. National Vulnerability Database.