Adobe has just rolled out emergency security updates to fix a wave of maximum-severity vulnerabilities threatening both Adobe ColdFusion and Adobe Campaign Classic. If left unpatched, these weaknesses let hackers take complete control of affected systems, steal private data, and run malicious code. Security experts warn that attackers are already trying to abuse these flaws, making immediate updates absolutely vital for businesses worldwide.

The sudden influx of these severe bugs has even forced Adobe to change how it releases security fixes. Starting on July 14, 2026, the company will move from a monthly schedule to releasing patches twice a month. According to Adobe’s security leadership, the rapid rise of artificial intelligence has allowed both defenders and attackers to find software bugs at an unprecedented pace. Because hackers can now turn a public bug report into a working cyberweapon in just a matter of hours, faster patch cycles have become a necessity to keep networks safe.

The Highest Threat Level: ColdFusion Under Attack

The bulk of the danger sits squarely on Adobe ColdFusion. The tech giant confirmed that its latest updates patch multiple vulnerabilities that earned a perfect 10.0 risk score. These flaws open the door for criminals to bypass standard security walls, elevate their system privileges, view restricted files, and execute dangerous code remotely. The issues specifically impact older versions of the software, and Adobe has delivered the critical fixes inside ColdFusion 2023 Update 21 and ColdFusion 2025 Update 10.

Independent security researchers who broke down the patches discovered that the bugs are remarkably easy to exploit. For instance, one flaw involves how the system handles file uploads. While ColdFusion turns off file uploads by default, any administrator who manually enables the feature unintentionally opens a massive backdoor. Once turned on, hackers do not even need a password to access the upload gateway. They can simply send a malicious request that forces the system to save dangerous files directly onto the server. Even worse, the system saves these files with top-level administrative permissions, giving the attacker total dominance over the machine.

The threat is no longer theoretical. Within hours of the details going public, security monitors caught hackers actively trying to exploit one of the path traversal bugs, tracked as CVE-2026-48282. In one recorded attack originating from an IP address in India, an attacker attempted to use a specialized command payload to peer into core Windows configuration files.

Campaign Classic Servers At Risk

At the same time, Adobe issued a separate warning for organizations running Adobe Campaign Classic on Windows and Linux systems. A severe authorization flaw, labeled as CVE-2026-48286, carries another perfect 10.0 severity rating because it allows outsiders to run unauthorized commands across the corporate network.

Fortunately, this specific problem does not affect every single user. Adobe stated that its own cloud-hosted customers are already safe, as the company updated its internal systems automatically. The real danger belongs to companies running on-premise setups or utilizing hybrid environments with local components. Corporate IT teams managing these local servers must manually install the ACC v7: 7.4.3 build 9397 update immediately to lock out potential intruders.

Though Adobe initially stated it found no widespread abuse of these specific Campaign bugs prior to the release, the rapid exploitation of the companion ColdFusion flaws proves that hackers are moving fast. Network administrators must treat these updates as an absolute priority before automated hacking tools scan and compromise their systems.