What happened. Adobe released patches for multiple maximum-severity (CVSS 10.0) vulnerabilities across Adobe ColdFusion and Adobe Campaign Classic. Per Adobe, the ColdFusion updates resolve flaws that could lead to arbitrary code execution, privilege escalation, arbitrary file-system reads, and security-feature bypass.

Who's affected. Organizations running ColdFusion or Campaign Classic. ColdFusion in particular tends to run older, business-critical web applications that are internet-facing and infrequently touched — the worst combination for a max-severity RCE.

What to do now. Patch now, not at the next cycle. ColdFusion has a well-documented pattern of exploitation within days of a patch release, as attackers reverse-engineer the fix. If you can't patch immediately, restrict external access and watch for web-shell deployment and anomalous outbound connections from the ColdFusion host.

Our read. Seven CVSS 10.0s in one release is a loud signal, and history says the exploitation clock is already running. The recurring failure mode is not the missing patch itself — it's not knowing you still run an exposed ColdFusion instance until an attacker finds it first. That's an attack-surface visibility problem: you can only patch what you know you have. Continuous discovery and verification of your external footprint is what turns “Adobe released a fix” into “we confirmed our three ColdFusion servers are patched and the two shadow ones are shut down” — before the PoC lands.

Reporting by The Hacker News, linked above.