Adobe ColdFusion and Commerce vulnerabilities enable remote code execution
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple vulnerabilities in Adobe ColdFusion and Commerce products allow remote code execution, privilege escalation, and denial of service.
CERT-FR has published an advisory documenting multiple vulnerabilities affecting Adobe ColdFusion 2023 (versions before 2023.0.23) and ColdFusion 2025 (versions before 2025.0.12), as well as Adobe Commerce, Adobe Commerce B2B, and Magento Open Source installations lacking the August 2026 security patches. The vulnerabilities enable attackers to execute arbitrary remote code, escalate privileges, cause remote denial of service, bypass security policies, and conduct cross-site scripting attacks. The advisory references 22 CVEs published in Adobe's security bulletins APSB26-90 and APSB26-92 dated 11 August 2026.
Affected organizations should prioritize patching ColdFusion instances to version 2023.0.23 or later (2023 branch) or 2025.0.12 or later (2025 branch), and apply the August 2026 patches to Commerce, Commerce B2B, and Magento Open Source deployments. The advisory does not indicate active exploitation in the wild but emphasizes the severity of the vulnerabilities, particularly those allowing arbitrary code execution and privilege escalation.
Mentioned in this report
Detection guidance
Adobe ColdFusion Service Spawning Shell or LOLBin Child Process
ColdFusion server process (coldfusion.exe or ColdFusion-hosted java.exe) spawning a command interpreter or common post-exploitation binary, consistent with RCE through an exposed ColdFusion instance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe ColdFusion Service Spawning Shell or LOLBin Child Process
description: Detects the ColdFusion server process spawning cmd, PowerShell or common
living-off-the-land binaries. This is the typical post-exploitation pattern after
remote code execution against a public-facing ColdFusion instance. Generalises on
the parent/child relation, not on any specific CVE payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent_cf:
ParentImage|endswith: \coldfusion.exe
selection_parent_java:
ParentImage|endswith: \java.exe
ParentImage|contains: \ColdFusion
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
- \whoami.exe
- \net.exe
- \net1.exe
- \rundll32.exe
- \regsvr32.exe
condition: 1 of selection_parent_* and selection_child
falsepositives:
- ColdFusion applications that intentionally call cfexecute to run batch files or
admin scripts
- ColdFusion installer or updater routines launching cmd.exe during patching
level: high
id: c549db6f-9922-5ee0-94dd-afd73df6973b
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1017
Web Server or PHP Process Spawning Shell With Download or Reverse Shell Pattern
Web server or PHP-FPM process (such as Magento/Adobe Commerce hosts) spawning a shell with download-and-execute or reverse-shell command-line patterns. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server or PHP Process Spawning Shell With Download or Reverse Shell Pattern
description: Detects Linux web server or PHP-FPM processes, as used by Adobe Commerce/Magento,
spawning a shell whose command line contains download-and-execute or reverse-shell
patterns. This is typical post-exploitation after RCE on a public-facing web application.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- php-fpm
- /apache2
- /httpd
- /nginx
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- curl
- wget
- /dev/tcp/
- nc -e
- base64 -d
- mkfifo
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Deployment or cache-warming scripts invoked from PHP that legitimately use curl
or wget
- Administrative plugins that shell out to download extensions
level: high
id: dbcfbec6-4ade-5816-8f1d-5a2482d57874
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1017
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1017
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs