# Adobe patches critical flaws in Campaign, ColdFusion

Published: 2026-07-01 · Severity: medium
Canonical: https://vorant.io/reports/424fb322-66ae-5f32-b391-b79cafe9e835/adobe-patches-critical-flaws-in-campaign-coldfusion

> Adobe released patches for multiple vulnerabilities in Campaign Classic and ColdFusion, including unrestricted file upload and path traversal flaws that could enable arbitrary code execution.

Adobe has issued security updates addressing multiple vulnerabilities across Campaign Classic and ColdFusion products. The most severe vulnerabilities affect ColdFusion 2025 Update 9 and earlier, and ColdFusion 2023 Update 20 and earlier, involving unrestricted file upload, improper input validation, path traversal, reflected XSS, and SSRF issues. Campaign Classic ACC v7 (7.4.3 build 9396 and earlier) is affected by an incorrect authorization vulnerability.

Successful exploitation could allow attackers to execute arbitrary code in the context of the logged-on user. The impact depends on user privileges, with administrative accounts facing higher risk including potential program installation, data manipulation, and account creation. Organizations running these Adobe products should prioritize patching, particularly those with internet-facing ColdFusion deployments.

There are currently no reports of active exploitation in the wild. Adobe has released updates to address all identified vulnerabilities, and organizations should apply patches immediately following appropriate testing.

## Mentioned in this report

- Vulnerabilities: CVE-2026-48276, CVE-2026-48277, CVE-2026-48281, CVE-2026-48282 (KEV), CVE-2026-48283, CVE-2026-48285, CVE-2026-48286, CVE-2026-48307, CVE-2026-48313 (templated), CVE-2026-48314, CVE-2026-48315, CVE-2026-48316

## Detection guidance (public sample)

### ColdFusion Java Process Spawning Command Shell (Possible Exploitation)

ATT&CK: T1203

Detects cmd.exe/powershell.exe/sh spawned by the ColdFusion Java process, consistent with post-exploitation of a ColdFusion file upload/RCE vulnerability leading to arbitrary code execution in the context of the ColdFusion service account. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ColdFusion Java Process Spawning Command Shell
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \jrun.exe
    - \java.exe
    - \coldfusion.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \certutil.exe
    - \mshta.exe
  filter_admin_task:
    CommandLine|contains:
    - ColdFusionMX9ScheduledTask
    - cfusion\bin\healthcheck
  condition: selection_parent and selection_child and not filter_admin_task
falsepositives:
- Legitimate ColdFusion scheduled tasks or admin scripts that intentionally call system
  utilities
- Custom ColdFusion CFX extensions that shell out to command-line tools
level: high
tags:
- attack.t1203
- attack.execution
id: f2206d9e-eb93-5b5a-99b8-6c7a607e5cc7
status: experimental
author: Vorant
```

### Web Shell File Dropped in ColdFusion Web Root via Upload Directory

ATT&CK: T1203

Detects creation of script files (.cfm, .cfc, .jsp) in ColdFusion upload or wwwroot directories, which is a common outcome of exploiting unrestricted file upload vulnerabilities in ColdFusion to drop a web shell for arbitrary code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Script File Written to ColdFusion Web Root or Upload Directory
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - \wwwroot\
    - \cfusion\
    TargetFilename|endswith:
    - .cfm
    - .cfc
    - .jsp
  filter_normal_deploy:
    Image|endswith:
    - \devenv.exe
    - \msbuild.exe
  condition: selection and not filter_normal_deploy
falsepositives:
- Legitimate application deployment or updates pushing new .cfm/.cfc pages to the
  web root
- Developer tools syncing source-controlled ColdFusion templates to the server
level: medium
tags:
- attack.t1203
- attack.persistence
id: d5746300-2ecf-55f7-9494-79897d58642f
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-066

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/424fb322-66ae-5f32-b391-b79cafe9e835/adobe-patches-critical-flaws-in-campaign-coldfusion.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup