Adobe Rushes Out Fixes for 88 Security Flaws, Eight of Them Critical in ColdFusion
Two weeks after hackers exploited a separate ColdFusion flaw within hours of its disclosure, Adobe is back with another urgent patch batch covering a dozen products.
Key points
- Adobe released security updates for 12 products on Tuesday, fixing 88 vulnerabilities.
- Eight critical flaws in ColdFusion, Adobe's web-application server software, could let attackers run malicious code or seize elevated control of a system.
- Adobe rated the ColdFusion update Priority 1, its highest urgency level, meaning customers should apply it immediately.
- None of the 88 vulnerabilities are known to be actively exploited yet, but a separate ColdFusion flaw patched two weeks ago was attacked within hours of going public.
- ColdFusion 2025 Update 11 and ColdFusion 2023 Update 22 close all 13 ColdFusion bugs addressed in this round.
Adobe pushed out security fixes Tuesday covering 12 products and patching 88 separate weaknesses. The most urgent are in ColdFusion, the company's software that businesses use to build and run websites and web-based tools.
Eight of the 13 ColdFusion flaws carry a critical rating. Critical means an attacker can cause serious harm without much effort: execute arbitrary code (run whatever software commands they choose on a company's server) or escalate privileges (gain administrator-level control they should not have). The relevant CVE identifiers, the standard numbering system researchers use to track individual flaws, are CVE-2026-48318, CVE-2026-48322, CVE-2026-48284, CVE-2026-48321, CVE-2026-48325, CVE-2026-48319, CVE-2026-48324 and CVE-2026-48327.
The vulnerability classes include SQL injection (where an attacker sneaks database commands into a form field), missing authentication (where a system simply forgets to check who is asking), path traversal (where an attacker tricks software into opening files it was never meant to touch) and improper input validation.
Why does the timing matter here?
Two weeks ago Adobe patched six maximum-severity ColdFusion flaws. One was attacked in the wild within hours of disclosure, a pattern we tracked in our 3 July report. That history is exactly why Adobe assigned Priority 1 to this week's ColdFusion update. Do not wait.
Tuesday's release also covered Adobe Commerce, fixing two critical bugs (CVE-2026-48356 and CVE-2026-48358) that could allow privilege escalation or code execution. Experience Manager, used to manage website content, received patches for two critical flaws (CVE-2026-48259 and CVE-2026-48359), both exploitable for code execution. Illustrator had one critical flaw (CVE-2026-48334), an improper input validation bug that could grant elevated system access.
Adobe says none of the 88 flaws are being actively exploited right now. That window can close fast.
Should you worry?
If your organisation runs any Adobe server software, confirm with your IT team today that Tuesday's patches are applied. For consumers using Illustrator or Premiere Pro, check for updates manually this week. The exploitation clock on ColdFusion flaws has recently started within hours; there's no reason to assume this batch will be different.
