Update, 6 July 2026: The prediction below did not take long to come true. Attackers are now exploiting one of these flaws in the wild, a maximum-severity path-traversal bug tracked as CVE-2026-48282 that gives unauthenticated attackers arbitrary file read and write, according to BleepingComputer. By one honeypot network's account, exploitation appeared within roughly two hours of public disclosure. If you run ColdFusion and have not patched, treat this as an active incident, not a maintenance task.

Adobe has shipped patches for seven maximum-severity vulnerabilities, each rated a perfect 10.0 on the CVSS scale, across ColdFusion and Campaign Classic, as reported by The Hacker News. The ColdFusion flaws, Adobe says, could allow arbitrary code execution, privilege escalation, file reads, and security-feature bypass, the full menu.

Seven tens in a single release is a loud signal on its own, but the more useful context is history. ColdFusion has a long, well-documented pattern of being exploited within days of a patch, as attackers reverse-engineer the fix to find the very bug it closes. And it tends to run exactly the kind of software that ages badly in the corner of a network: older, business-critical web applications that are internet-facing and rarely touched.

Which points at the real problem, and it is not the patch. It is knowing that you still run an exposed ColdFusion server at all. The recurring failure mode is discovering a forgotten instance only after an attacker finds it first. Patching is easy once you know what you have; the hard part is continuous visibility into an external footprint that quietly sprouts shadow servers nobody remembers standing up.

Patch now rather than at the next cycle, restrict external access if you cannot, and treat the release as a prompt to inventory every ColdFusion instance you run, including the ones that are not on anyone's list.

Sources: The Hacker News and BleepingComputer.