Adobe Patches ColdFusion, Campaign Classic Flaws
Adobe ColdFusion and Campaign Classic contain multiple vulnerabilities, including ones enabling arbitrary code execution, with no known exploitation yet.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 12 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-48282 as exploited in the wild.
CIS/MS-ISAC issued an advisory covering multiple vulnerabilities in Adobe Campaign Classic and Adobe ColdFusion. The most severe flaws could allow arbitrary code execution in the context of the logged-on user, potentially enabling installation of programs, data manipulation, or creation of new accounts, with impact scaling based on the victim's account privileges.
Affected products include Adobe Campaign Classic ACC v7 (7.4.3 build 9396 and earlier), ColdFusion 2025 (Update 9 and earlier), and ColdFusion 2023 (Update 20 and earlier). The vulnerabilities span incorrect authorization, unrestricted file upload, improper input validation, path traversal, reflected XSS, and SSRF. There are currently no reports of in-the-wild exploitation. Organizations are advised to apply Adobe's stable channel updates promptly and implement standard mitigations such as least privilege, application allowlisting, and vulnerability management processes.
Mentioned in this report
Detection guidance
ColdFusion Process Spawning Command Shell
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the ColdFusion Java process (coldfusion/jrun) spawning cmd.exe or powershell.exe, a common post-exploitation indicator when arbitrary code execution vulnerabilities (e.g. those patched in Adobe ColdFusion 2023/2025) are abused to run OS commands. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ColdFusion Process Spawning Command Shell
description: Detects Adobe ColdFusion's Java process (coldfusion.exe/jrun.exe/java.exe
running ColdFusion) launching a command interpreter, which is consistent with exploitation
of arbitrary code execution flaws (improper input validation, unrestricted file
upload) rather than normal ColdFusion operation.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \coldfusion.exe
- \jrun.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \powershell_ise.exe
- \cscript.exe
- \wscript.exe
filter_admin_scripts:
CommandLine|contains:
- ColdFusionAdmin\scheduledtasks
condition: selection and not filter_admin_scripts
falsepositives:
- Legitimate ColdFusion scheduled task or admin scripting that intentionally invokes
OS-level scripts
- Third-party ColdFusion extensions that shell out to helper utilities
level: high
id: 0f262056-1479-57e2-8275-32d0d15e6694
status: experimental
author: Vorant
Unrestricted File Upload Dropping Web Shell Extension in ColdFusion Webroot
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects new .cfm/.cfc/.jsp files written into ColdFusion web application directories by the ColdFusion server process itself, indicative of exploitation of unrestricted file upload or path traversal flaws to place a web shell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unrestricted File Upload Dropping Web Shell Extension in ColdFusion Webroot
description: Detects the ColdFusion server process writing new server-side script
files (.cfm, .cfc, .jsp) into web-accessible directories, consistent with exploitation
of unrestricted file upload or path traversal vulnerabilities to drop a web shell
rather than normal application deployment.
tags:
- attack.persistence
- attack.t1203
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \coldfusion.exe
- \jrun.exe
TargetFilename|endswith:
- .cfm
- .cfc
- .jsp
TargetFilename|contains:
- \wwwroot\
- \CustomTags\
filter_deployment:
TargetFilename|contains:
- \lib\updates\
condition: selection and not filter_deployment
falsepositives:
- Legitimate application deployment or hotfix installation writing new .cfm/.cfc files
to the webroot
- Developer activity directly editing ColdFusion templates on the server
level: medium
id: ea8a95af-5e9a-5f02-87be-53b470407236
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-066
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs