This Is a Drop-Everything Moment for ColdFusion and Campaign Classic
Adobe has released security patches for seven maximum‑severity CVSS 10.0 vulnerabilities in its ColdFusion web application platform and Campaign Classic marketing automation product, all of which can lead to remote code execution in low‑complexity, no‑click attacks if left unpatched. This is not a routine ColdFusion security patch; it is a full‑blown emergency change window. When you see CVSS 10.0 vulnerability ratings tied to remote code execution Adobe products that sit at the heart of web apps and customer engagement pipelines, you are looking at potential business‑stopping incidents, not theoretical risks. The uncomfortable truth is that many organizations still treat middleware and marketing platforms as second‑tier assets compared to their core application stack. That mindset needs to end here. These flaws sit directly on systems that often hold customer data, credentials, and integration keys. If an attacker gains arbitrary code execution on ColdFusion or pulls off a Campaign Classic exploit, they are not "testing your perimeter" – they are operating inside it.
What Exactly Is Broken: Remote Code Execution Everywhere You Care
Under the hood, the situation is stark: ColdFusion updates resolve critical vulnerabilities that can lead to arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass. Several issues stem from unrestricted upload of files with dangerous types and improper input validation, which are classic mistakes with catastrophic consequences when they occur on a server‑side framework. Another path traversal bug pushes the risk further, enabling direct arbitrary code execution via crafted paths rather than any clever social engineering. On the marketing side, Adobe Campaign Classic suffers from a CVSS 10.0 vulnerability caused by incorrect authorization, allowing attackers to execute arbitrary code on affected on‑premise instances and hybrid components. In plain language: if you are exposing these platforms to the internet and they are unpatched, you are offering attackers an easy way to run their own code inside your environment with almost no resistance.
Who Is at Risk and Which Versions Must Change Now
Enterprise teams running ColdFusion should consider any instance not at ColdFusion 2023 Update 21 or ColdFusion 2025 Update 10 as at‑risk infrastructure. Those updates address the arbitrary code execution, privilege escalation, file‑read, and security bypass flaws, including multiple CVSS 10.0 vulnerability entries tied to unsafe file upload and input validation. Web application development shops that still depend on ColdFusion – and there are more than many CISOs realize – must treat these as immediate change requirements, not future backlog items. On the marketing side, Campaign Classic instances at ACC v7 7.4.3 build 9396 and earlier on Windows or Linux are vulnerable to the incorrect authorization flaw that can lead to arbitrary code execution. Adobe is clear that CVE‑2026‑48286 affects on‑premise deployments and hybrid setups, while Adobe‑hosted instances have already been updated and require no customer action. If you manage your own Campaign Classic infrastructure, you either move to build 9397 or you accept that your campaign engine is a potential initial access vector.
No Exploits Yet – But the Window Is Shrinking Fast
Adobe notes that it has not found any exploits in the wild for these ColdFusion and Campaign Classic issues at the time of the patch release. That sounds reassuring, but it should be read as a countdown, not a comfort blanket. The vulnerabilities are low‑complexity, require no user interaction, and are rated with priority 1, meaning Adobe itself believes they have a high risk of being targeted. Once detailed advisories exist, offensive security teams – and attackers – can move from "unknown" to working exploit code in hours. Adobe is explicit about why it is shifting to twice‑monthly security advisories: frontier AI models are accelerating vulnerability discovery and shrinking the time between disclosure and exploitation. In its own words, "the window between public vulnerability disclosure and active exploitation is compressing from days to hours". The takeaway for defenders is simple: the only meaningful response is to patch faster than attackers can weaponize the information you now have.
What Developers and IT Teams Must Do Within 72 Hours
If you run ColdFusion or Campaign Classic on‑premise, you should be working from a 72‑hour clock right now. Adobe recommends administrators install the update "as soon as possible (for example, within 72 hours)" for affected product versions and platforms. That timeline should drive your change management process, not the other way around. The practical steps are clear: schedule and apply ColdFusion 2023 Update 21 or 2025 Update 10 across all environments, from internet‑facing production through internal staging and QA. At the same time, upgrade Campaign Classic to ACC v7 7.4.3 build 9397 on all on‑premise and hybrid nodes. Developers should assume that any custom upload and input‑validation logic layered on ColdFusion may mask exploitation attempts, not prevent them, and must not be treated as a substitute for vendor patches. Security teams should add detection for suspicious file uploads, path traversal patterns, and unexpected process spawning from ColdFusion and Campaign Classic services, but all of that is secondary to the main job: apply the ColdFusion security patch and the Campaign Classic fix now, then verify every system is actually at the new build levels.
