Adobe Patches ColdFusion, Campaign Classic Flaws
Adobe ColdFusion and Campaign Classic contain multiple vulnerabilities, including ones enabling arbitrary code execution, with no known exploitation yet.
CIS/MS-ISAC issued an advisory covering multiple vulnerabilities in Adobe Campaign Classic and Adobe ColdFusion. The most severe flaws could allow arbitrary code execution in the context of the logged-on user, potentially enabling installation of programs, data manipulation, or creation of new accounts, with impact scaling based on the victim's account privileges.
Affected products include Adobe Campaign Classic ACC v7 (7.4.3 build 9396 and earlier), ColdFusion 2025 (Update 9 and earlier), and ColdFusion 2023 (Update 20 and earlier). The vulnerabilities span incorrect authorization, unrestricted file upload, improper input validation, path traversal, reflected XSS, and SSRF. There are currently no reports of in-the-wild exploitation. Organizations are advised to apply Adobe's stable channel updates promptly and implement standard mitigations such as least privilege, application allowlisting, and vulnerability management processes.
Mentioned in this report
Detection guidance
ColdFusion Process Spawning Command Shell
Detects the ColdFusion Java process (coldfusion/jrun) spawning cmd.exe or powershell.exe, a common post-exploitation indicator when arbitrary code execution vulnerabilities (e.g. those patched in Adobe ColdFusion 2023/2025) are abused to run OS commands. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ColdFusion Process Spawning Command Shell
description: Detects Adobe ColdFusion's Java process (coldfusion.exe/jrun.exe/java.exe
running ColdFusion) launching a command interpreter, which is consistent with exploitation
of arbitrary code execution flaws (improper input validation, unrestricted file
upload) rather than normal ColdFusion operation.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \coldfusion.exe
- \jrun.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \powershell_ise.exe
- \cscript.exe
- \wscript.exe
filter_admin_scripts:
CommandLine|contains:
- ColdFusionAdmin\scheduledtasks
condition: selection and not filter_admin_scripts
falsepositives:
- Legitimate ColdFusion scheduled task or admin scripting that intentionally invokes
OS-level scripts
- Third-party ColdFusion extensions that shell out to helper utilities
level: high
id: 0f262056-1479-57e2-8275-32d0d15e6694
status: experimental
author: Vorant
Unrestricted File Upload Dropping Web Shell Extension in ColdFusion Webroot
Detects new .cfm/.cfc/.jsp files written into ColdFusion web application directories by the ColdFusion server process itself, indicative of exploitation of unrestricted file upload or path traversal flaws to place a web shell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unrestricted File Upload Dropping Web Shell Extension in ColdFusion Webroot
description: Detects the ColdFusion server process writing new server-side script
files (.cfm, .cfc, .jsp) into web-accessible directories, consistent with exploitation
of unrestricted file upload or path traversal vulnerabilities to drop a web shell
rather than normal application deployment.
tags:
- attack.persistence
- attack.t1203
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \coldfusion.exe
- \jrun.exe
TargetFilename|endswith:
- .cfm
- .cfc
- .jsp
TargetFilename|contains:
- \wwwroot\
- \CustomTags\
filter_deployment:
TargetFilename|contains:
- \lib\updates\
condition: selection and not filter_deployment
falsepositives:
- Legitimate application deployment or hotfix installation writing new .cfm/.cfc files
to the webroot
- Developer activity directly editing ColdFusion templates on the server
level: medium
id: ea8a95af-5e9a-5f02-87be-53b470407236
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-066
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free