[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFfSnsLU7vQEjCaMpjeF8ed6gPXAgUL9wX8CGx3_p2Ug":3},{"article":4,"iocs":46,"watch_terms":75,"solutions":76,"lesson":166},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"f1b91b85-967b-487f-9524-ca1153397209","Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic","adobe-patches-7-cvss-10-0-flaws-in-coldfusion-and-campaign-classic-291f9c","Adobe has released patches for multiple maximum-severity security flaws impacting Adobe ColdFusion and Adobe Campaign Classic. The ColdFusion updates \"resolves critical and important vulnerabilities that could lead to arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass,\" Adobe said in an alert released Tuesday. The vulnerabilities are listed","Adobe released security updates addressing multiple maximum-severity vulnerabilities in ColdFusion and Adobe Campaign Classic, including 7 flaws with CVSS 10.0 scores that could lead to arbitrary code execution, privilege escalation, and file system access. The vulnerabilities span unrestricted file uploads, improper input validation, and path traversal issues across multiple versions. Adobe noted it has not found active exploitation in the wild and is shifting to twice-monthly security bulletins due to accelerated vulnerability discovery via AI models.","Adobe patches 7 CVSS 10.0 flaws in ColdFusion and Campaign Classic enabling code execution.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fadobe-patches-7-cvss-100-flaws-in.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiP2LpF3s-oL3WaiHtAZ9N33J120bvGnWDoQ39eE1fyToERHmJgkAtMzarRyW9-gOG0N4U1_nOEQmwg-3krYIZDcXXB6JYpurMezefSiM5-ygJd9CuuS1sS-gHNjoKgBRayO0wBow5GB1yaanR55TW2fwus6MQXwlqeXDJ2Xu7z2fiOGbPXo4qio4LpXZPO\u002Fs1600\u002Fadobe.jpg","2026-07-01T15:25:46+00:00","2026-07-01T16:00:23.638162+00:00",9,[17,20,23,25],{"name":18,"type":19},"Adobe","vendor",{"name":21,"type":22},"ColdFusion","product",{"name":24,"type":22},"Adobe Campaign Classic",{"name":26,"type":27},"Artificial Intelligence","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,41],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",[47,51,53,56,58,60,63,66,69,72],{"type":48,"value":49,"context":50},"cve","CVE-2026-48276","ColdFusion unrestricted file upload leading to arbitrary code execution (CVSS 10.0)",{"type":48,"value":52,"context":50},"CVE-2026-48283",{"type":48,"value":54,"context":55},"CVE-2026-48277","ColdFusion improper input validation leading to arbitrary code execution (CVSS 10.0)",{"type":48,"value":57,"context":55},"CVE-2026-48281",{"type":48,"value":59,"context":55},"CVE-2026-48316",{"type":48,"value":61,"context":62},"CVE-2026-48282","ColdFusion path traversal leading to arbitrary code execution (CVSS 10.0)",{"type":48,"value":64,"context":65},"CVE-2026-48313","ColdFusion path traversal leading to arbitrary file system read (CVSS 9.3)",{"type":48,"value":67,"context":68},"CVE-2026-48315","ColdFusion improper input validation leading to privilege escalation (CVSS 9.3)",{"type":48,"value":70,"context":71},"CVE-2026-48286","Adobe Campaign Classic incorrect authorization leading to arbitrary code execution (CVSS 10.0)",{"type":48,"value":73,"context":74},"CVE-2026-48307","ColdFusion vulnerability discovered by Anirudh Anand and Matan Sandori",[18,21,24],{"controls":77,"vendors":165},[78,107,136],{"slug":79,"name":80,"problem":81,"products":82},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":108,"name":109,"problem":110,"products":111},"patch-management","Automated patch management","Known holes get closed in days, not months.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":137,"name":138,"problem":139,"products":140},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[141,149,157],{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":153,"product_name":154,"url":155,"description":156},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":158,"vendor_name":159,"vendor_logo":160,"product_slug":161,"product_name":162,"url":163,"description":164},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",[],{"slug":167,"title":168,"body":169,"framework_refs":170,"framework_notes":181},"adobe-patches-7-maximum-severity-flaws-in-coldfusion-and-campaign-classic","Adobe Patches 7 Maximum-Severity Flaws in ColdFusion and Campaign Classic","Adobe disclosed seven CVSS 10.0 vulnerabilities across ColdFusion and Campaign Classic, covering unrestricted file uploads, improper input validation, and path traversal flaws that could allow arbitrary code execution and full system compromise. Maximum CVSS scores indicate the highest possible risk, meaning unpatched systems face catastrophic exposure with little barrier to exploitation. ColdFusion in particular has a well-documented history of being targeted in the wild, making rapid patching critical even when active exploitation has not yet been confirmed. Notably, Adobe's acknowledgment that AI-assisted research is accelerating vulnerability discovery signals that patch cycles must become faster and more structured across the industry.",[171,172,173,174,175,176,177,178,179,180],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST SI-2: Flaw Remediation","NIST SI-10: Information Input Validation","NIST SA-11: Developer Testing and Evaluation","OWASP Top 10: A03 Injection \u002F A08 Software and Data Integrity Failures","ISO\u002FIEC 27001:2022 Control 8.8: Management of Technical Vulnerabilities","ITIL 4: Change Enablement \u002F Vulnerability Management Practice",{}]