Adobe Issues Priority 1 Patches for Three CVSS 10.0 ColdFusion and Campaign Classic Flaws

Adobe released updates for ColdFusion 2025.0.12 and 2023.0.23 plus Campaign Classic ACC v7 7.4.4 build 9400. The flaws include OS command injection, eval injection, and incorrect authorization paths that permit code execution or denial of service. Priority 1 rating signals Adobe's assessment of imminent targeting risk. Adobe-hosted Campaign instances were already remediated; only on-premise and hybrid components require customer action. Sansec reported active exploitation of the related CVE-2026-71362 in Adobe Commerce and Magento Open Source, allowing session hijacking between customer accounts. This follows a separate CVSS 10.0 Campaign Classic patch issued two weeks earlier for CVE-2026-48449. Procurement records show persistent use of ColdFusion in U.S. federal and defense contractor environments, increasing blast radius if exploits emerge. No public technical attribution or in-wild samples have been confirmed for the three new CVSS 10.0 issues, yet the clustering of maximum-severity authorization and injection flaws within fourteen days deviates from Adobe's typical disclosure cadence. Contract awards and job postings continue to reference legacy ColdFusion instances without mandatory patching SLAs, creating a measurable exposure window. Administrators must apply updates inside 72 hours. Expect scanning activity within seven days and possible proof-of-concept release within thirty days absent rapid patch adoption. Monitor EDR telemetry for post-authentication command execution on unpatched hosts.