Adobe September Security Update Patches 170+ Vulnerabilities: ColdFusion 9.9 RCE Rated Priority 1, Must Patch Within Three Days
Adobe September security update patches 170+ vulnerabilities. Two ColdFusion code-execution flaws rated Priority 1. Campaign Classic patches a CVSS 10.0 OS command injection. Experience Manager alone accounts for 107 fixes.
Adobe released its September 2026 security update, patching more than 170 vulnerabilities. Two ColdFusion code-execution flaws are rated Priority 1; Adobe requires remediation within three days of release. Campaign Classic patches a CVSS 10.0 OS command-injection vulnerability. Experience Manager alone accounts for 107 fixes. Adobe confirmed no in-the-wild exploitation at disclosure except the Commerce zero-day.
Overview
ColdFusion CVE-2026-48273 (CVSS 9.9) is an eval injection (CWE-95). Attacker-controlled input reaches a dynamic evaluation path and is executed by the ColdFusion interpreter. A low-privileged remote attacker can trigger it with no user interaction and scope changed. Successful exploitation executes arbitrary code in the service-account context. Affected versions: ColdFusion 2025 (≤Update 12) and 2023 (≤Update 23). Fixed in 2025 Update 13 and 2023 Update 24. The same batch includes CVE-2026-75746 (CVSS 9.1).
Campaign Classic CVE-2026-82004 (CVSS 10.0) is an OS command-injection vulnerability leading to arbitrary code execution. Affects ACC v7 7.4.4 build 9401 and earlier. Internet-exposed Campaign instances carry the highest risk.
Technical Details and Impact
ColdFusion has long been a priority target—large numbers of enterprises run customer portals, business systems, and APIs on it, and historical disclosures were weaponized within days. ColdFusion CVE-2026-48282 was recently confirmed exploited in the wild. Distribution of the 170+ vulnerabilities: Experience Manager 107, Acrobat Reader 32, Photoshop 8, Illustrator 3, Animate and Photoshop Mobile among smaller fixes. Commerce/Magento patches 9 (including the previously reported, in-the-wild StyleSmuggler zero-day CVE-2026-75650, plus 2 critical privilege-escalation and 6 high-severity issues).
Remediation
- ColdFusion: upgrade to 2025 Update 13 / 2023 Update 24. As a Priority 1 update, complete within three days. Instances that cannot upgrade immediately: tighten network exposure; allow only trusted sources.
- Campaign Classic: upgrade to versions after build 9401. Prioritize internet-facing instances.
- Commerce/Magento: besides patching, merchants affected by StyleSmuggler must rotate encryption keys and all protected credentials at the source—admin passwords, database credentials, integration tokens, OAuth keys, SSH and deploy keys, API Key. Changing keys only inside Magento does not invalidate information already read by the attacker.
- Experience Manager, Acrobat, Photoshop, and others: update to each product's latest patched release on the standard cycle.
- General: after updating, hunt anomalous scheduled tasks, template-processing logs, and failed-notification records; confirm no leftover WebShells.
References
- HKCERT: Adobe Monthly Security Update (September 2026)
- ThreatAft: ColdFusion CVE-2026-48273 CVSS 9.9 Eval Injection RCE
- MGI Computers: Adobe Patches Over 170 Vulnerabilities