Adobe ColdFusion's Nine New CVEs: Seven Score a Perfect 10.0

Seven vulnerabilities with a perfect CVSS score of 10.0, disclosed on the same day, in software that’s still quietly running behind a meaningful share of enterprise intranets and government portals. That’s what Adobe shipped on July 1, 2026, in a security bulletin covering ColdFusion 2023, ColdFusion 2025, and the on-premise edition of Campaign Classic v7. One of the seven, a path traversal bug, was already being exploited in the wild within hours of the advisory going public.

If you have a ColdFusion server anywhere in your infrastructure, on a marketing site, an internal portal, a legacy admin tool nobody’s touched in three years, this is the week to check its version number.

What a CVSS 10.0 actually means

A 10.0 isn’t just “bad.” It’s the combination of every factor CVSS scores stacking in the attacker’s favor at once: exploitable over the network, low attack complexity, no privileges required, no user interaction needed, and impact that reaches full compromise of confidentiality, integrity, and availability. In plain terms: an attacker who can reach the server over the network, with no account and no help from anyone inside, can run arbitrary code on it.

Adobe’s July 1 bulletin has six vulnerabilities meeting that bar attached to specific CVE identifiers:

CVE	Type	CVSS
CVE-2026-48276	Unrestricted upload of dangerous file type	10.0
CVE-2026-48283	Unrestricted upload of dangerous file type	10.0
CVE-2026-48277	Improper input validation	10.0
CVE-2026-48281	Improper input validation	10.0
CVE-2026-48316	Improper input validation	10.0
CVE-2026-48282	Path traversal	10.0

Two different vulnerability classes, unrestricted file upload and improper input validation, both landing on the same maximum score, plus a path traversal bug rounding out the set. All six lead to arbitrary code execution on the affected server. This isn’t one bug with six CVE numbers; it’s six structurally different ways in.

The one that’s already being used

CVE-2026-48282, the path traversal flaw, is the one to treat as an emergency rather than a maintenance item. Security researchers observed active exploitation attempts within hours of Adobe’s disclosure. That’s a much shorter window than most CVEs get before attackers start probing for it, which suggests either the vulnerability was already known to some attacker community before the public advisory, or automated scanning against newly-disclosed CVEs has gotten fast enough that “hours” is now the realistic baseline to plan around, not “weeks.”

Either way, the practical takeaway is the same: don’t schedule ColdFusion patching for next sprint. Patch it this week, and check your logs for anything unusual in the meantime.

Who’s affected and what to run

The fixes landed in:

• ColdFusion 2023 Update 21
• ColdFusion 2025 Update 10

If you’re running ColdFusion 2021 or earlier, Adobe is not shipping a fix for your version, full stop. Unsupported releases don’t get security patches regardless of severity. If that’s your situation, the only real options are migrating to a supported ColdFusion release or isolating the server from any network path an unauthenticated attacker could reach, which for most deployments means pulling it off the public internet entirely, not just adding a WAF rule and hoping.

Campaign Classic v7’s on-premise edition is also affected. If you run Campaign Classic in Adobe’s managed cloud, check with Adobe directly on whether the cloud service required action on your end; on-premise deployments need the same patch-now treatment as ColdFusion.

Why Adobe is changing its own patch calendar

Buried in the same announcement is a bigger structural signal: Adobe is moving ColdFusion and Campaign Classic security bulletins from monthly to twice-monthly, starting July 14, 2026. Adobe’s own security leadership attributed the change directly to AI-assisted vulnerability research accelerating faster than a monthly cadence can responsibly absorb, and made the point explicitly that the same frontier AI capabilities helping Adobe’s team find bugs are equally available to the people trying to exploit them first.

That’s worth sitting with for a second. A monthly patch cycle was designed for a world where finding a new class of critical vulnerability in a mature product was a slow, expensive process. If AI-assisted fuzzing and code analysis compress that timeline for defenders, it compresses it for attackers by the same amount. Vendors moving to faster release cadences isn’t just Adobe being extra cautious, it’s a rational response to a genuinely faster discovery-to-exploit pipeline across the industry.

What to actually do this week

Check your ColdFusion version today. Not “this sprint,” today. If you’re below ColdFusion 2023 Update 21 or ColdFusion 2025 Update 10, you’re running one of these seven bugs unpatched right now.

Prioritize CVE-2026-48282. If you can only patch one thing immediately, patch the path traversal bug first, since it’s the one with confirmed active exploitation.

Audit for orphaned ColdFusion instances. ColdFusion has a long tail of legacy deployments that predate the current engineering team, internal tools, an old client portal, a marketing microsite. These are exactly the servers that miss a patch cycle because nobody’s watching them. A technical due diligence pass over your infrastructure is the right exercise if you’re not confident you know every ColdFusion instance your organization runs.

Watch for the twice-monthly cadence change on July 14. If your patch management process assumes monthly Adobe bulletins, that assumption breaks in eight days.

This is the second on-premise enterprise platform in as many months to land a CVE with confirmed active exploitation shortly after disclosure. If patch management for legacy platforms has been an afterthought at your organization, this is the pattern telling you to stop treating it that way.