Adobe’s June 30 security updates for ColdFusion and Adobe Campaign Classic should be treated as a fast triage item, not a routine end-of-month patch. The ColdFusion bulletin fixes 11 vulnerabilities in ColdFusion 2025 and 2023, including six CVSS 10.0 flaws that can lead to arbitrary code execution. A separate Campaign Classic bulletin fixes a CVSS 10.0 incorrect-authorization issue in on-premise deployments.
Adobe originally said it was not aware of in-the-wild exploits for the issues. Since then, The Hacker News reported early exploitation activity against CVE-2026-48282, a ColdFusion path-traversal vulnerability, citing a single observed attempt to read a Windows file shortly after public disclosure. That does not mean every exposed ColdFusion server is already compromised, but it does mean administrators should assume the disclosure-to-probing window is already open.
What Adobe fixed
The affected ColdFusion versions are ColdFusion 2025 Update 9 and earlier and ColdFusion 2023 Update 20 and earlier, across all platforms. Adobe’s fixed versions are ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21, both assigned the company’s highest priority rating.
The most urgent ColdFusion issues are not all the same bug class. Adobe lists two unrestricted-file-upload vulnerabilities, CVE-2026-48276 and CVE-2026-48283; three improper-input-validation issues, CVE-2026-48277, CVE-2026-48281, and CVE-2026-48316; and the path-traversal flaw CVE-2026-48282. Each carries a CVSS base score of 10.0 and can result in arbitrary code execution under Adobe’s assessment.
The same ColdFusion update also fixes CVE-2026-48313, a path-traversal flaw that can allow arbitrary file-system reads; CVE-2026-48315, an improper-input-validation issue tied to privilege escalation; a reflected cross-site scripting issue tracked as CVE-2026-48307; an SSRF flaw tracked as CVE-2026-48285; and CVE-2026-48314, a lower-scored path-traversal privilege-escalation issue.
Campaign Classic has a narrower but still severe exposure. Adobe says CVE-2026-48286 affects ACC v7 version 7.4.3 build 9396 and earlier on Windows and Linux, and the fixed build is 7.4.3 build 9397. The issue applies to on-premise Campaign deployments, including hybrid environments that keep on-premise components. Adobe-hosted instances have already been updated, according to the bulletin.
Why ColdFusion deserves extra attention
ColdFusion patches are often operationally awkward because the product tends to sit in older internal and customer-facing web stacks where ownership is split between application teams, Windows or Linux administrators, and security operations. That is exactly the kind of environment where a high-priority patch can be “known” without actually being deployed everywhere.
The technical details also matter. watchTowr Labs’ patch analysis described the affected area as broader than a simple list of CVE labels suggests, with fixes touching file write, file read, file move, file delete, directory creation, and directory listing behavior. The researchers also noted changes around file upload handling, including newly blocked extensions and path-traversal checks.
That combination is why the practical question is not only whether Update 10 or Update 21 is installed. Admins should also check whether risky functionality was enabled before the patch, whether upload endpoints were reachable without the expected controls, and whether any internet-facing ColdFusion hosts show signs of probing before the update landed.
What admins should check now
Start with inventory. Identify every ColdFusion 2025 and 2023 instance, including development, staging, disaster-recovery, partner-facing, and old application servers that may not sit in the main patch-management dashboard. For each instance, verify the exact update level rather than relying on package names or asset tags.
Next, separate internet-facing ColdFusion servers from internal-only systems. Publicly reachable servers should move first, followed by systems that accept file uploads, handle authenticated customer workflows, sit behind weak VPN segmentation, or run with elevated service-account permissions. A ColdFusion server that can write files as a powerful local account deserves special scrutiny even if it is not directly exposed to the public internet.
For ColdFusion, review web server logs and ColdFusion application logs for suspicious path-traversal patterns, unexpected file-read attempts, unusual upload requests, newly written files under web-accessible directories, and requests referencing Windows files such as win.ini or Unix-like paths such as /etc/passwd. Security teams should also look for uploaded templates, unfamiliar archive files, webshell-like filenames, and sudden changes to directories that normally should not receive user content.
For Campaign Classic, the first question is deployment model. Adobe-hosted instances require no customer-side patch action for this bulletin, but on-premise and hybrid deployments do. Teams running ACC v7 should verify build 9397, confirm which components are exposed to internal networks or the internet, and check whether Campaign servers have broad database, file-system, or integration privileges that would raise the impact of code execution.
Adobe’s ColdFusion bulletin also repeats hardening guidance that should not be skipped after the update. Admins should review the ColdFusion lockdown guide, update supported JDK or JRE builds, and check the serial-filter settings Adobe documents for JEE installations. Those controls are not a substitute for patching, but they reduce the damage path when a future bug reaches the same kind of server-side surface.
The patch cadence is changing too
This update also lands just before a process change from Adobe. The company is moving security bulletin publication from a monthly rhythm to twice-monthly releases starting July 14, 2026, with bulletins planned for the second and fourth Tuesday of each month. Adobe tied the change to faster vulnerability discovery as AI-assisted research accelerates both defensive review and attacker reverse engineering.
For enterprise teams, the operational lesson is simple: Adobe products that run on servers should be tracked like infrastructure, not like desktop creative software. ColdFusion and Campaign Classic can sit close to customer data, marketing workflows, authentication systems, databases, file stores, and legacy application code. When a bulletin contains multiple unauthenticated code-execution paths, the response has to include exposure mapping and compromise checks, not just a change ticket that says the installer ran.
The near-term priority is clear. Patch ColdFusion 2025 to Update 10, patch ColdFusion 2023 to Update 21, update on-premise Campaign Classic to build 9397, and review logs from the disclosure window onward. Then keep these systems in the next twice-monthly patch cycle, because the window between published advisory and real probing is no longer comfortably measured in weeks.
