Adobe August 2026 Patch Update: Critical ColdFusion and Commerce Vulnerabilities

CVE-2026-48362, the most severe ColdFusion flaw, allows an unauthenticated attacker to execute arbitrary operating system commands via a crafted request . This can lead to full server compromise. The eval injection (CVE-2026-48273) and incorrect authorization (CVE-2026-71384) bugs similarly open the door for code execution and privilege escalation .

Adobe Commerce (APSB26-92) — Priority 2 (Apply Within 30 Days)

Adobe resolved 7 vulnerabilities in Commerce and Magento Open Source .

• Affected versions: Adobe Commerce 2.4.9-2026-jul and earlier, plus 2.4.8 through 2.4.4 release lines; Magento Open Source same versions; Commerce B2B modules .
• Exploitation status: Adobe reported no active exploits in the wild, but Commerce is known to have been targeted in past attacks .
• Patching guidance: Apply the August 2026 Isolated patches from the Adobe Commerce knowledge base. Commerce on Cloud customers can also deploy via Magento Cloud Patches. Patches are cumulative per release line — the July 2026 patch must be applied first. Adobe recommends applying within 30 days (Priority 2) .

The Commerce flaw CVE-2026-71362 is particularly dangerous because it requires no authentication and no user interaction, allowing an unauthenticated attacker to escalate privileges over the network . This could expose sensitive customer data and enable unauthorized system modifications .

Broader Context: Adobe's August 2026 Patch Tuesday

Adobe released five security bulletins on August 11, addressing a total of 51 CVEs across :

• Adobe ColdFusion (15 CVEs)
• Adobe Commerce / Magento Open Source (7 CVEs)
• Adobe Campaign Classic (multiple critical flaws, including two CVSS 10.0)
• Adobe Lightroom Classic
• Content Credentials SDK

Of the 51 vulnerabilities, 33 were rated critical . The highest-severity items across the entire release were the ColdFusion OS command injection (CVSS 10.0) and Campaign Classic's two CVSS 10.0 flaws .

Key Takeaways for Security Teams

1. ColdFusion users should patch immediately. The CVSS 10.0 RCE flaw (CVE-2026-48362) can lead to full server compromise. Adobe's Priority 1 rating signals an elevated risk of future targeting.
2. Commerce users should patch within 30 days. While no active exploitation has been detected, the unauthenticated privilege escalation vector (CVE-2026-71362) is a serious concern, especially given Commerce's history as a target.
3. No active exploits have been observed for any of these vulnerabilities as of the advisory date, but the absence of proof-of-concept code does not guarantee safety .
4. Verify patch application in staging environments before rolling to production, especially for ColdFusion where the fix may affect custom applications.