# Adobe ColdFusion and Commerce vulnerabilities enable remote code execution

Published: 2026-08-13 · Severity: severe · Sectors: technology, retail
Canonical: https://vorant.io/reports/92a4b719-5e77-5760-a57d-7b4bb89eeb4c/adobe-coldfusion-and-commerce-vulnerabilities-enable-remote-code-execution

> Multiple vulnerabilities in Adobe ColdFusion and Commerce products allow remote code execution, privilege escalation, and denial of service.

CERT-FR has published an advisory documenting multiple vulnerabilities affecting Adobe ColdFusion 2023 (versions before 2023.0.23) and ColdFusion 2025 (versions before 2025.0.12), as well as Adobe Commerce, Adobe Commerce B2B, and Magento Open Source installations lacking the August 2026 security patches. The vulnerabilities enable attackers to execute arbitrary remote code, escalate privileges, cause remote denial of service, bypass security policies, and conduct cross-site scripting attacks. The advisory references 22 CVEs published in Adobe's security bulletins APSB26-90 and APSB26-92 dated 11 August 2026.

Affected organizations should prioritize patching ColdFusion instances to version 2023.0.23 or later (2023 branch) or 2025.0.12 or later (2025 branch), and apply the August 2026 patches to Commerce, Commerce B2B, and Magento Open Source deployments. The advisory does not indicate active exploitation in the wild but emphasizes the severity of the vulnerabilities, particularly those allowing arbitrary code execution and privilege escalation.

## Mentioned in this report

- Vulnerabilities: CVE-2026-21273, CVE-2026-21279, CVE-2026-25652, CVE-2026-34635, CVE-2026-48273, CVE-2026-48362, CVE-2026-48375, CVE-2026-48376, CVE-2026-48384, CVE-2026-48386, CVE-2026-48411, CVE-2026-48412, CVE-2026-48413, CVE-2026-48414, CVE-2026-48415, CVE-2026-48416, CVE-2026-48440, CVE-2026-71362 (KEV), CVE-2026-71383, CVE-2026-71384, CVE-2026-71385, CVE-2026-71386, CVE-2026-71387

## Detection guidance (public sample)

### Adobe ColdFusion Service Spawning Shell or LOLBin Child Process

ATT&CK: T1190

ColdFusion server process (coldfusion.exe or ColdFusion-hosted java.exe) spawning a command interpreter or common post-exploitation binary, consistent with RCE through an exposed ColdFusion instance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Adobe ColdFusion Service Spawning Shell or LOLBin Child Process
description: Detects the ColdFusion server process spawning cmd, PowerShell or common
  living-off-the-land binaries. This is the typical post-exploitation pattern after
  remote code execution against a public-facing ColdFusion instance. Generalises on
  the parent/child relation, not on any specific CVE payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent_cf:
    ParentImage|endswith: \coldfusion.exe
  selection_parent_java:
    ParentImage|endswith: \java.exe
    ParentImage|contains: \ColdFusion
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \whoami.exe
    - \net.exe
    - \net1.exe
    - \rundll32.exe
    - \regsvr32.exe
  condition: 1 of selection_parent_* and selection_child
falsepositives:
- ColdFusion applications that intentionally call cfexecute to run batch files or
  admin scripts
- ColdFusion installer or updater routines launching cmd.exe during patching
level: high
id: c549db6f-9922-5ee0-94dd-afd73df6973b
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1017
```

### Web Server or PHP Process Spawning Shell With Download or Reverse Shell Pattern

ATT&CK: T1059.004

Web server or PHP-FPM process (such as Magento/Adobe Commerce hosts) spawning a shell with download-and-execute or reverse-shell command-line patterns. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server or PHP Process Spawning Shell With Download or Reverse Shell Pattern
description: Detects Linux web server or PHP-FPM processes, as used by Adobe Commerce/Magento,
  spawning a shell whose command line contains download-and-execute or reverse-shell
  patterns. This is typical post-exploitation after RCE on a public-facing web application.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - php-fpm
    - /apache2
    - /httpd
    - /nginx
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - curl
    - wget
    - /dev/tcp/
    - nc -e
    - base64 -d
    - mkfifo
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Deployment or cache-warming scripts invoked from PHP that legitimately use curl
  or wget
- Administrative plugins that shell out to download extensions
level: high
id: dbcfbec6-4ade-5816-8f1d-5a2482d57874
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1017
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1017

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/92a4b719-5e77-5760-a57d-7b4bb89eeb4c/adobe-coldfusion-and-commerce-vulnerabilities-enable-remote-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup