Summary

CVE-2026-48362

CVE-2026-48362 is a critical OS command injection vulnerability in Adobe ColdFusion 2023 and 2025 that allows unauthenticated, remote attackers to achieve arbitrary code execution. The vulnerability does not require user interaction and impacts the scope of the application, posing a significant risk to affected environments.

Affected products:

• ColdFusion 2025 (<= 2025.0.11)
• ColdFusion 2023 (<= 2023.0.22)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-48362

Related in this roundup: CVE-2026-21273, CVE-2026-48386.

CVE-2026-71384

CVE-2026-71384 is an incorrect authorization vulnerability in Adobe ColdFusion 2023 and 2025. The flaw allows an unauthenticated, adjacent attacker to bypass security features, resulting in unauthorized read and write access, and potentially a denial-of-service condition. Although the vulnerable component is restricted to an administrative network zone by default, successful exploitation does not require user interaction.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-71384

CVE-2026-21273

CVE-2026-21273 describes an improper input validation vulnerability in Adobe ColdFusion 2025 and 2023. A low-privileged attacker can exploit this flaw by enticing a user to open a malicious file, leading to unauthorized read and write access and privilege escalation on the affected system.

Affected products:

• ColdFusion 2025 (<= 2025.0.11)
• ColdFusion 2023 (<= 2023.0.22)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-21273

Related in this roundup: CVE-2026-48362, CVE-2026-48386.

CVE-2026-21279

Adobe ColdFusion versions 2025 (<= 2025.0.11) and 2023 (<= 2023.0.22) are vulnerable to an improper input validation flaw that allows for a security feature bypass. An unauthenticated remote attacker can exploit this vulnerability to gain unauthorized read and limited write access to the affected system without requiring user interaction.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-21279

CVE-2026-25652

CVE-2026-25652 is an Incorrect Authorization vulnerability in Adobe ColdFusion 2025 and 2023 versions. A low-privileged attacker can exploit this flaw to escalate privileges and gain unauthorized read and write access to the system. Exploitation is local and does not require user interaction.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-25652

CVE-2026-34635

Adobe ColdFusion versions 2025 (<= 2025.0.11) and 2023 (<= 2023.0.22) contain a Use of Hard-coded Cryptographic Key vulnerability. A low-privileged attacker can exploit this issue to bypass security features and obtain unauthorized read and write access without user interaction. The vulnerability results in a scope change, potentially allowing for cross-security-domain impact.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-34635

CVE-2026-48385

Adobe ColdFusion is vulnerable to an OS command injection flaw (CVE-2026-48385) that allows low-privileged, remote attackers to bypass security features and gain unauthorized write access to the system. The vulnerability does not require user interaction and impacts the system scope.

Affected products:

• ColdFusion (<= 2025.0.11)
• ColdFusion (<= 2023.0.22)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-48385

CVE-2026-48386

Adobe ColdFusion is vulnerable to a broken or risky cryptographic algorithm (CWE-327), which can be exploited by a remote, unauthenticated attacker to disclose sensitive memory contents. Successful exploitation allows for the unauthorized access to sensitive information without requiring user interaction.

Affected products:

• ColdFusion 2025 (<= 2025.0.11)
• ColdFusion 2023 (<= 2023.0.22)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-48386

Related in this roundup: CVE-2026-48362, CVE-2026-21273.

CVE-2026-48439

The CAI Content Credentials SDKs and command-line tool are vulnerable to an uncontrolled resource consumption issue (CWE-400). A remote, unauthenticated attacker can exploit this vulnerability to exhaust system resources, leading to a denial-of-service (DoS) condition. No user interaction is required for successful exploitation.

Affected products:

• Content Credentials Rust SDK (<= c2pa-v0.90.5)
• Content Credentials Command-Line Tool (<= c2patool-v0.27.5)
• Content Credentials JS SDK (<= @contentauth/c2pa@0.14.2)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-48439

Related in this roundup: CVE-2026-48442.

CVE-2026-48440

Adobe ColdFusion versions 2025 (<= 2025.0.11) and 2023 (<= 2023.0.22) are vulnerable to a heap-based buffer overflow. This vulnerability allows an unauthenticated, remote attacker to execute arbitrary code in the context of the current user without requiring user interaction. The exploitation process is non-deterministic, relying on specific environmental conditions.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-48440

CVE-2026-48442

The Adobe Content Credentials SDK and associated tooling are vulnerable to a path traversal vulnerability (CWE-22) which allows an attacker to perform arbitrary file system reads. The vulnerability does not require user interaction and impacts multiple language-specific SDKs and the CLI tool.

Affected products:

• Content Credentials Rust SDK (<= c2pa-v0.90.5)
• Content Credentials Command-Line Tool (<= c2patool-v0.27.5)
• Content Credentials JS SDK (<= @contentauth/c2pa-v0.27.5)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-48442

Related in this roundup: CVE-2026-48439.

CVE-2026-27302

Adobe Campaign Classic is vulnerable to an incorrect authorization flaw (CWE-863) that allows an unauthenticated remote attacker to execute arbitrary code. The vulnerability has a CVSS v3.1 base score of 10.0 and does not require user interaction to exploit.

Affected products:

• Adobe Campaign Classic (<= 7.4.3 build 9399)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-27302

Related in this roundup: CVE-2026-71398.

CVE-2026-71362

Adobe Commerce and Magento Open Source are vulnerable to an Incorrect Authorization flaw (CWE-863) that allows an unauthenticated, remote attacker to perform privilege escalation. The vulnerability does not require user interaction and can be exploited to gain unauthorized access to sensitive resources.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-71362

CVE-2026-71398

Adobe Campaign Classic (ACC) is vulnerable to an incorrect authorization flaw (CWE-863) that allows an unauthenticated remote attacker to execute arbitrary code. The vulnerability has a CVSS base score of 10.0 and does not require user interaction for exploitation.

Affected products:

• Adobe Campaign Classic (<= 7.4.3 build 9399)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-71398

Related in this roundup: CVE-2026-27302.

CVE-2026-47940

Adobe Lightroom Classic is vulnerable to an integer overflow or wraparound condition that can lead to arbitrary code execution. The vulnerability is triggered when a user is enticed to open a maliciously crafted file, allowing an attacker to execute code within the context of the current user session.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-47940

CVE-2026-48397

Adobe Lightroom Classic is vulnerable to a deserialization of untrusted data issue that allows an attacker to achieve arbitrary code execution. The vulnerability requires user interaction, specifically the opening of a malicious file by the victim, which triggers the flaw within the application context.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-48397

CVE-2026-48405

Adobe Lightroom Classic is vulnerable to an out-of-bounds write (CWE-787) flaw that allows an attacker to achieve arbitrary code execution. Successful exploitation requires a user to open a specially crafted malicious file, which triggers the memory corruption within the application context.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-48405

CVE-2026-48406

Adobe Lightroom Classic is vulnerable to an out-of-bounds write (CWE-787) that allows for arbitrary code execution. A local attacker can exploit this by convincing a user to open a specially crafted malicious file within the application.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-48406

CVE-2026-48407

Adobe Lightroom Classic is susceptible to an out-of-bounds write vulnerability that can be exploited by an attacker to achieve arbitrary code execution. Successful exploitation requires a user to open a specially crafted malicious file, which triggers the memory corruption issue within the application's process context.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-48407

CVE-2026-48408

Adobe Lightroom Classic is vulnerable to an out-of-bounds write (CWE-787) that allows for arbitrary code execution. Successful exploitation requires a user to open a specially crafted malicious file, which triggers the vulnerability in the context of the logged-in user.

Affected products:

• Lightroom Classic (<= 15.4)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-48408

CVE-2026-48410

Adobe Lightroom Classic is vulnerable to an out-of-bounds write, which can be exploited by an attacker to achieve arbitrary code execution. Successful exploitation requires the user to open a malicious file, making it a client-side execution risk.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-48410

CVE-2026-48413

Adobe Commerce and Magento Open Source are vulnerable to a stored Cross-Site Scripting (XSS) attack via malicious input in form fields. A low-privileged attacker can inject scripts that execute in a victim's browser, potentially leading to unauthorized account or session control. This vulnerability involves a change in security scope.

Affected products:

• Adobe Commerce (<= 2026-07-31)
• Adobe Commerce B2B (<= 2026-07-31)
• Magento Open Source (<= 2026-07-31)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-48413

CVE-2026-48415

Adobe Commerce and Magento Open Source are vulnerable to an Incorrect Authorization flaw (CWE-863) that allows a low-privileged, remote attacker to bypass security controls. Successful exploitation grants unauthorized read and write access without requiring user interaction, potentially impacting data integrity and availability.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-48415

CVE-2026-48416

CVE-2026-48416 is an incorrect authorization vulnerability in Adobe Commerce and Magento Open Source that allows remote, unauthenticated attackers to bypass security measures and gain unauthorized read access to sensitive data. The vulnerability does not require user interaction and is exploitable over the network.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-48416