CRITICAL: Adobe ColdFusion CVE-2026-48362 Rated CVSS 10.0 for Command Injection

Adobe's August Patch Tuesday arrived carrying three separate CVSS 10.0 vulnerabilities, which is usually the sort of number that means somebody fat fingered a scoring calculator. Nobody fat fingered anything. ColdFusion and Campaign Classic each shipped a flawless ten this month, and while security teams were busy reading those two advisories, attackers went after an entirely different Adobe product. Adobe stated at release time that it had no evidence of exploitation against the Commerce privilege escalation bug. Researchers watched exploitation attempts begin within hours of the advisory going public. That gap between no known exploitation and actively targeted was measured in a single business day, and it is the whole story of this patch cycle.

The one that scores a perfect ten

CVE-2026-48362 is an OS command injection flaw in Adobe ColdFusion, classified as CWE-78, and it carries a CVSS 3.1 base score of 10.0 on the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Read that vector slowly, because every single field in it is set to the worst available value. The attack comes over the network. Complexity is low, meaning there are no race conditions to win and no special configuration required. Privileges required are none, so the attacker does not need an account. User interaction is none, so nobody has to click anything. Confidentiality, integrity, and availability impacts are all high. Then there is the scope change, which is the field that pushes an already ugly 9.8 up to a full 10.0. Scope change means the vulnerable component can be used to affect resources beyond its own security authority. The bug does not stay in its lane.

Adobe describes the impact as arbitrary code execution in the context of the current user, which on a typical ColdFusion deployment means the service account running the application server. On a lot of installations that account has considerably more reach than anyone intended back when the box was first stood up. NVD published the entry on August 11 and last modified it on August 13. Affected builds are ColdFusion 2023 through update 22 and ColdFusion 2025 through update 11. The fixes are 2023.0.23 and 2025.0.12. Adobe assigned the update its Priority 1 rating, the highest urgency tier in the company's scheme, which comes with a stated expectation that administrators install within 72 hours rather than waiting politely for the next maintenance window.

ColdFusion is not finished, either. CVE-2026-48273 is an eval injection flaw scoring 9.9 that also results in code execution, and CVE-2026-71384 is an authorization bypass at 9.6 that leads to denial of service. Both are addressed in the same 2023.0.23 and 2025.0.12 builds, so there is exactly one patch to apply and no excuse for partial remediation.

Campaign Classic and the marketing server nobody remembers owning

The other perfect scores live in Adobe Campaign Classic. CVE-2026-71398 and CVE-2026-27302 are both incorrect authorization vulnerabilities, CWE-863, each rated 10.0 with the same brutal AV:N/AC:L/PR:N/UI:N/S:C profile as the ColdFusion command injection issue. Both end in arbitrary code execution. Rounding out the set, CVE-2026-48381 is a SQL injection flaw at 9.0 that also leads to code execution. Everything is fixed in Campaign Classic v7 version 7.4.4 build 9400, with build 9399 and earlier vulnerable.

There is one meaningful piece of good news buried in here. The Campaign Classic updates apply only to on premise deployments. Adobe hosted instances were already remediated on the vendor side, so if your client's Campaign environment is managed by Adobe, that particular fire is already out. The problem is that Campaign Classic is precisely the kind of system that gets installed by a marketing agency, handed off to nobody in particular, and then quietly forgotten while it continues to hold every customer email address and campaign record the organization has ever collected. Two unauthenticated remote code execution bugs at CVSS 10.0 sitting on a forgotten marketing server is not a theoretical risk. It is a data breach with a delayed fuse.

The Commerce bug that did not wait

CVE-2026-71362 is the one that turned into an incident rather than a patch note. It is an incorrect authorization vulnerability in Adobe Commerce scoring 9.1 on the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, and it lets an unauthenticated remote attacker escalate privileges and take over other customer accounts. Sansec reported that exploitation requires no existing account, no administrator privileges, and no user interaction whatsoever. In practice the attack switches a customer session over to another account, handing the attacker whatever that victim can see, which on an ecommerce platform means order history, stored addresses, and saved payment metadata.

Affected versions run wide. Adobe Commerce 2.4.4 through 2.4.9, Adobe Commerce B2B 1.3.3 through 1.5.3, and Magento Open Source 2.4.6 through 2.4.9 are all vulnerable up to and including their July 2026 patch levels. The August 2026 releases contain the fix, and Adobe shipped an isolated patch for this flaw alongside six other defects across the three products.

Here is the part worth sitting with. Adobe published the advisory saying it had no evidence of exploitation in the wild, while noting that threat actors have a long history of targeting Commerce specifically. Sansec confirmed active targeting within hours of that publication. This is the modern patch gap in miniature. The advisory itself is the reconnaissance tip. Attackers diff the patch, build the exploit, and start scanning while defenders are still opening the ticket. If your remediation process assumes you get a comfortable few weeks of grace after a vendor advisory drops, that assumption expired several years ago and nobody sent a memo.

What exploitation looks like on your network

For the ColdFusion command injection issue, the telltale signature is a web request to a ColdFusion endpoint followed almost immediately by process creation from the application server account. Watch for cfusion or coldfusion service processes spawning cmd.exe, powershell.exe, bash, or sh, because ColdFusion has very little legitimate reason to be launching shells. Outbound connections from the ColdFusion host to addresses it has never spoken to before, especially on odd ports shortly after an inbound HTTP request, deserve immediate attention. Attackers who land on a ColdFusion box historically drop a web shell into the wwwroot or CFIDE directories, so file integrity monitoring on those paths pays for itself the first time it fires.

On the Commerce side, the pattern to hunt is session anomalies. Look for a single source address associated with authenticated actions across multiple distinct customer accounts in a short window, or sessions whose account identifier changes mid session without a fresh login event. Spikes in account detail views, address book reads, or order history queries that are not matched by corresponding login activity in your authentication logs are the clearest tell you will get.

For Campaign Classic, treat any unexpected process execution or newly created scheduled workflow on the Campaign server as suspicious, and audit the operator accounts on that platform now rather than after somebody exports the mailing list.

What to actually do

Patch ColdFusion to 2023.0.23 or 2025.0.12 today. Patch on premise Campaign Classic installations to v7 7.4.4 build 9400. Apply the August 2026 Commerce, Commerce B2B, or Magento Open Source release, and if a full version upgrade cannot happen this week, take Adobe's isolated patch for CVE-2026-71362 as a stopgap. There are no meaningful workarounds published for the CVSS 10.0 issues, which means patching is the mitigation and everything else is theater.

While you are in there, do the unglamorous work. Restrict the ColdFusion administrator interface so it is not reachable from the internet, because a startling number of them still are. Verify that the ColdFusion service account is not running with local administrator or domain privileges. Put the Campaign Classic server behind a VPN or an access control list if it has no business being publicly exposed. On Commerce, force a session invalidation across all customer accounts after patching, because a patch does not evict an attacker who is already holding a hijacked session.

Finally, go looking for the deployments you do not know about. Every organization of a certain age has a ColdFusion instance running some internal form that a contractor built a decade ago and nobody has logged into since. That instance sits on the same network as everything else, and CVSS 10.0 does not care that you forgot it existed.

The MSP angle

This patch cycle is a clean sales conversation because it hands you a concrete number. Three CVSS 10.0 flaws in a single vendor's monthly release, one of them under attack the same day it was disclosed, is a far more persuasive case for a managed vulnerability and rapid patching retainer than any generic risk slide ever produced. Lead with the 72 hour Priority 1 window and ask the prospect honestly whether their current process could hit it.

The second opportunity is asset discovery. Pitch a paid attack surface assessment framed specifically around finding the forgotten ColdFusion, Campaign, and Magento instances that no longer have an owner. It is a fixed scope engagement, it produces a findings report the client can act on immediately, and it reliably uncovers enough shadow infrastructure to justify an expanded monitoring contract on the spot.