Adobe Patches Three CVSS 10.0 Flaws in ColdFusion and Campaign Classic

Adobe published three security bulletins this week covering ColdFusion, Commerce/Magento Open Source, and Campaign Classic — APSB26-90, APSB26-92, and APSB26-123. Three of the disclosed vulnerabilities score a maximum CVSS 10.0, and all fall into the category that matters most operationally: unauthenticated, remote flaws that hand an attacker full control of a web-facing server.

The maximum-severity bugs

In ColdFusion 2025.0.12 and 2023.0.23, CVE-2026-48362 (CVSS 10.0) is an operating system command injection flaw that Adobe says leads to arbitrary code execution — the same bug class that has repeatedly put internet-facing ColdFusion servers in attackers' crosshairs over the past few years. The same bulletin fixes CVE-2026-48273 (CVSS 9.9), an eval injection issue with the same code-execution outcome, and CVE-2026-71384 (CVSS 9.6), an incorrect-authorization flaw usable for denial of service.

Campaign Classic v7 accounts for the other two maximum scores: CVE-2026-71398 and CVE-2026-27302 (both CVSS 10.0), incorrect-authorization issues fixed in build 7.4.4/9400 that Adobe rates as leading to arbitrary code execution. A third Campaign Classic bug, CVE-2026-48381 (CVSS 9.0), is a SQL injection flaw with the same impact. Adobe notes the Campaign Classic fixes apply only to on-premise and hybrid installs — Adobe-managed cloud instances were already remediated.

Already under attack — just not these ones

The third bulletin, for Commerce and Magento Open Source, covers CVE-2026-71362 (CVSS 9.1), an incorrect-authorization bug caused by the platform failing to correctly bind a customer identity to a session. That lets an unauthenticated attacker switch an active session to a different customer's account, exposing their data. Adobe's advisory itself doesn't list active exploitation, but security firm Sansec reports its WAF began blocking exploitation attempts within hours of disclosure — a reminder that the highest CVSS score and the highest real-world risk aren't always the same bug.

What to do

• Patch ColdFusion to 2025.0.12 or 2023.0.23, and Campaign Classic on-premise/hybrid to v7 7.4.4 build 9400 — Adobe rates both bulletins Priority 1, its highest urgency, with deployment recommended within 72 hours.
• Treat CVE-2026-71362 in Commerce/Magento as already-exploited: patch it ahead of, or alongside, the CVSS 10.0 bugs, and review session logs for anomalous account-switching activity.
• Where immediate patching isn't possible, take internet-facing ColdFusion and Campaign Classic admin interfaces off the public internet — command-injection and authorization bugs in these platforms have a track record of fast weaponisation once technical details circulate.
• Inventory every ColdFusion, Commerce, and Campaign Classic instance you run, including test and staging systems — these are the ones most often missed in patch cycles and make an easy foothold.

None of the three CVSS 10.0 bugs are confirmed exploited in the wild as of writing, but that's a snapshot, not a guarantee — ColdFusion command-injection disclosures in particular have historically drawn rapid reverse-engineering once a patch reveals what changed.