Adobe Commerce, Magento, ColdFusion Patched
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT-FR flags over 40 CVEs in Adobe Commerce, Magento Open Source and ColdFusion, some enabling remote code execution and privilege escalation.
CERT-FR has issued an advisory consolidating Adobe's October 2026 security bulletins (APSB26-144 for ColdFusion and APSB26-153 for Commerce/Magento) covering more than 40 CVEs across Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and ColdFusion 2023/2025. The flaws span a wide range of impact categories including remote code execution, privilege escalation, remote denial of service, cross-site scripting (XSS), data integrity and confidentiality breaches, and security policy bypass.
Affected versions span multiple release branches of Adobe Commerce (2.4.4 through 2.4.10), Adobe Commerce B2B (1.3.3 through 1.5.4), Magento Open Source (2.4.7 through 2.4.10), and ColdFusion 2023 (pre-2023.0.26) and 2025 (pre-2025.0.14). No in-the-wild exploitation is noted in this advisory; it is a standard vendor patch bulletin distributed via CERT-FR. Given the breadth of e-commerce platforms affected and the presence of RCE and privilege escalation vectors, organizations running these products — particularly online retailers using Commerce/Magento — should prioritize patching to the versions specified in Adobe's bulletins.
Defenders should inventory all Adobe Commerce, Magento Open Source, Commerce B2B, and ColdFusion instances, confirm version numbers against the fixed releases listed, and apply the October 2026 patches promptly. Monitoring for anomalous admin access, unexpected code execution, or XSS exploitation attempts against Commerce/Magento storefronts and ColdFusion applications is advised pending full patch rollout.
Mentioned in this report
Detection guidance
ColdFusion Server Process Spawning Shell or Download Utility
Detects the Adobe ColdFusion service process spawning a command interpreter or common LOLBin, a typical post-exploitation pattern after ColdFusion RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ColdFusion Server Process Spawning Shell or Download Utility
id: ed216805-76ee-5eaf-84bb-f0c4659289ca
status: experimental
description: Detects the Adobe ColdFusion server process (coldfusion.exe or a Java/JRun
process running from a ColdFusion install directory) spawning cmd, PowerShell or
common download/recon utilities. Generic indicator of web-application RCE exploitation,
relevant to the Adobe ColdFusion patch bulletin.
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1301
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.003
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains: \ColdFusion
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \certutil.exe
- \bitsadmin.exe
- \mshta.exe
- \whoami.exe
- \net.exe
- \net1.exe
- \curl.exe
condition: selection_parent and selection_child
falsepositives:
- ColdFusion administrators running scheduled tasks or cfexecute calls that invoke
cmd.exe for maintenance scripts
- ColdFusion installer or updater launching helper commands during patching
level: high
author: Vorant
PHP or Web Server Process Spawning Shell with Recon or Download Commands on Linux
Detects PHP-FPM, Apache or Nginx worker processes (e.g. hosting Magento/Adobe Commerce) spawning a shell that runs recon, download or reverse-shell commands. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP or Web Server Process Spawning Shell with Recon or Download Commands on
Linux
id: cd3fdf20-3152-5523-a716-1c8e3f8f5319
status: experimental
description: Detects a PHP or web server process (php-fpm, php, apache2, httpd, nginx)
spawning a shell whose command line contains recon, download or reverse-shell primitives.
Indicates possible RCE exploitation of a PHP e-commerce platform such as Magento
or Adobe Commerce.
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1301
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /php-fpm
- /php
- /apache2
- /httpd
- /nginx
selection_shell:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- whoami
- id;
- curl
- wget
- /dev/tcp/
- nc -e
- base64 -d
- chmod +x
condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Magento extensions or cron-triggered PHP code that shell out to curl or wget for
legitimate integrations
- Deployment scripts executed through a PHP-based admin tool
level: high
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1301
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,571 reports from 145 sources, 595 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs