Who Is Affected
Organizations running Adobe Campaign Classic or Adobe ColdFusion — including NJ government agencies, enterprises, small and mid-sized businesses, and any developer teams maintaining ColdFusion web applications. Administrators of marketing automation stacks and public-facing ColdFusion apps should treat this as urgent.
What Happened
Adobe disclosed multiple vulnerabilities across Adobe Campaign Classic and Adobe ColdFusion. The most severe could allow arbitrary code execution in the context of the logged-on user. Depending on the user's privileges, an attacker could install programs, view or modify data, or create new accounts with full user rights.
Notable weakness classes include unrestricted file upload, improper input validation, path traversal, reflected cross-site scripting, server-side request forgery, and incorrect authorization.
When
Advisory issued July 1, 2026. There are currently no reports of exploitation in the wild — patch before that changes.
Where — Systems Affected
- Adobe Campaign Classic ACC v7: 7.4.3 build 9396 and earlier
- Adobe ColdFusion 2025: Update 9 and earlier
- Adobe ColdFusion 2023: Update 20 and earlier
Why It Matters — Risk Assessment
- Government (large / medium): High
- Government (small): Medium
- Business (large / medium): High
- Business (small): Medium
- Home users: Low
ColdFusion instances are frequently internet-facing, and the combination of unrestricted upload, path traversal, and SSRF flaws creates a realistic path to full server compromise if left unpatched.
How — Technical Summary
MITRE ATT&CK mapping: Execution (TA0002) via Exploitation for Client Execution (T1203).
Adobe Campaign Classic
- Incorrect Authorization — CVE-2026-48286
Adobe ColdFusion
- Unrestricted Upload of File with Dangerous Type — CVE-2026-48276, CVE-2026-48283
- Improper Input Validation — CVE-2026-48277, CVE-2026-48281, CVE-2026-48315, CVE-2026-48316
- Path Traversal — CVE-2026-48282, CVE-2026-48313, CVE-2026-48314
- Reflected Cross-Site Scripting — CVE-2026-48307
- Server-Side Request Forgery (SSRF) — CVE-2026-48285
Recommendations
- Patch immediately. Apply Adobe's stable-channel updates for Campaign Classic and ColdFusion after appropriate testing (M1051: Update Software; CIS Safeguards 7.1, 7.2, 7.6, 7.7).
- Apply least privilege. Run services as non-privileged accounts; restrict administrator rights to dedicated admin accounts (M1026; CIS Safeguards 4.7, 5.4).
- Restrict web-based content at the browser and email gateway — block unnecessary file types and enforce URL filtering (M1021; CIS Safeguards 9.3, 9.6, 2.3, 2.7).
- Enable anti-exploitation features (DEP, WDEG, macOS SIP / Gatekeeper) on servers and workstations (M1050; CIS Safeguard 10.5).
- Enforce execution controls — allowlist authorized software, libraries, and scripts (M1038; CIS Safeguards 2.5, 2.6, 2.7).
- Deploy endpoint prevention such as EDR or a host-based IPS (M1040; CIS Safeguards 13.2, 13.7).
- Test what you shipped. Run application penetration testing on ColdFusion apps and maintain an external pen-testing program (CIS Safeguards 16.13, 18.1, 18.2, 18.3).
How TeliApp Can Help
TeliApp helps New Jersey government agencies and enterprise clients operationalize vulnerability management, patch orchestration, least-privilege administration, and application penetration testing — the exact controls that neutralize this class of Adobe vulnerability. If your team needs help staging ColdFusion updates safely or auditing a public-facing ColdFusion or Campaign Classic deployment, get in touch.