Adobe Patches Seven Max-Severity ColdFusion and Campaign Classic Flaws

What Happened

Adobe has released an out-of-band security update addressing seven maximum-severity vulnerabilities across two enterprise products: ColdFusion (its widely-deployed web application development platform) and Campaign Classic (its marketing automation suite). "Maximum severity" in Adobe's classification means a CVSS score of 9.8 or 10.0 — the highest possible rating. The flaws span critical categories including remote code execution, arbitrary file read, and authentication bypass.

Why It Matters

ColdFusion has one of the worst track records of any enterprise web platform when it comes to in-the-wild exploitation. CISA has repeatedly warned that ColdFusion vulnerabilities attract active ransomware and state-sponsored threat actors within days — sometimes hours — of disclosure. Prior critical ColdFusion CVEs (including those from 2023 and 2024) were weaponized before many organizations had even read the advisory.

Seven max-severity flaws in a single patch cycle is unusually high. If any of these allow unauthenticated remote code execution — a realistic expectation at CVSS 10.0 — a public-facing ColdFusion server becomes a direct entry point into your network. Campaign Classic installations, often connected to CRM databases and customer PII, carry their own blast radius if compromised.

The combination of Adobe's patch cadence (these dropped outside the normal Patch Tuesday cycle, signaling urgency) and ColdFusion's exploitation history means the window between patch publication and active scanning is measured in days, not weeks.

What to Do

1. Inventory immediately. Identify every ColdFusion instance in your environment — including dev, staging, and internal servers that are sometimes overlooked. Do the same for Campaign Classic deployments.

1. Patch now, not during the next change window. Apply Adobe's updates as an emergency change. Check Adobe's security bulletin for the specific patch versions required for your ColdFusion release (2021, 2023, or 2025 update tracks).

1. Check for indicators of compromise first. Before patching a system you suspect may already be exposed, review web server logs for unusual POST requests to ColdFusion admin endpoints (/CFIDE/administrator/, /cf_scripts/) and look for newly created .cfm or .jsp webshells.

1. Restrict admin interfaces. If ColdFusion Administrator is reachable from the internet or broad internal networks, lock it down to specific management IPs at the firewall or network layer — even as a temporary control while patching proceeds.

1. Enable WAF rules. If you run a WAF in front of ColdFusion, enable or update ColdFusion-specific rule sets now. Most vendors will push signatures for newly disclosed CVEs quickly.

Do not treat this as a normal patching cycle. Historical precedent with ColdFusion is unambiguous: unpatched servers get owned fast.