Adoben elokuun 2026 tietoturvapäivitys: Kriittisiä haavoittuvuuksia ColdFusionissa ja Commercessa

On August 11, 2026, Adobe released security updates addressing over 50 vulnerabilities across its product line. The most urgent fixes target ColdFusion and Adobe Commerce, both widely deployed in enterprise environments. While Adobe reported no active exploitation at the time of disclosure, the severity of certain flaws — including a CVSS 10.0 remote code execution (RCE) vulnerability in ColdFusion — demands immediate attention from security teams .

Adobe ColdFusion (APSB26-90) — Priority 1 (Update Immediately)

Adobe patched 15 security defects in ColdFusion 2025 and 2023. Three were rated critical :

CVE	Type	CVSS	Impact
CVE-2026-48362	OS command injection	10.0	Remote code execution
CVE-2026-48273	Eval injection	9.9	Remote code execution
CVE-2026-71384	Incorrect authorization	9.6	Security control bypass, administrative access

• Affected versions: ColdFusion 2025 up to 2025.0.11, ColdFusion 2023 up to 2023.0.22. Fixed in 2025.0.12 and 2023.0.23 .
• Exploitation status: Adobe reported no active exploits in the wild as of release .
• Patching guidance: Apply the ColdFusion security update immediately. Adobe assigned Priority 1 (highest risk — "higher risk of being targeted in the wild") .

CVE-2026-48362, the most severe ColdFusion flaw, allows an unauthenticated attacker to execute arbitrary operating system commands via a crafted request . This can lead to full server compromise. The eval injection (CVE-2026-48273) and incorrect authorization (CVE-2026-71384) bugs similarly open the door for code execution and privilege escalation .

Adobe Commerce (APSB26-92) — Priority 2 (Apply Within 30 Days)

Adobe resolved 7 vulnerabilities in Commerce and Magento Open Source .

CVE	Type	CVSS	Impact
CVE-2026-71362	Incorrect authorization	9.1	Privilege escalation (unauthenticated, no user interaction)
Other patched CVEs	Various (high severity)	—	Arbitrary code execution, security feature bypass

• Affected versions: Adobe Commerce 2.4.9-2026-jul and earlier, plus 2.4.8 through 2.4.4 release lines; Magento Open Source same versions; Commerce B2B modules .
• Exploitation status: Adobe reported no active exploits in the wild, but Commerce is known to have been targeted in past attacks .
• Patching guidance: Apply the August 2026 Isolated patches from the Adobe Commerce knowledge base. Commerce on Cloud customers can also deploy via Magento Cloud Patches. Patches are cumulative per release line — the July 2026 patch must be applied first. Adobe recommends applying within 30 days (Priority 2) .

The Commerce flaw CVE-2026-71362 is particularly dangerous because it requires no authentication and no user interaction, allowing an unauthenticated attacker to escalate privileges over the network . This could expose sensitive customer data and enable unauthorized system modifications .

Broader Context: Adobe's August 2026 Patch Tuesday

Adobe released five security bulletins on August 11, addressing a total of 51 CVEs across :

• Adobe ColdFusion (15 CVEs)
• Adobe Commerce / Magento Open Source (7 CVEs)
• Adobe Campaign Classic (multiple critical flaws, including two CVSS 10.0)
• Adobe Lightroom Classic
• Content Credentials SDK

Of the 51 vulnerabilities, 33 were rated critical . The highest-severity items across the entire release were the ColdFusion OS command injection (CVSS 10.0) and Campaign Classic's two CVSS 10.0 flaws .

Key Takeaways for Security Teams

1. ColdFusion users should patch immediately. The CVSS 10.0 RCE flaw (CVE-2026-48362) can lead to full server compromise. Adobe's Priority 1 rating signals an elevated risk of future targeting.
2. Commerce users should patch within 30 days. While no active exploitation has been detected, the unauthenticated privilege escalation vector (CVE-2026-71362) is a serious concern, especially given Commerce's history as a target.
3. No active exploits have been observed for any of these vulnerabilities as of the advisory date, but the absence of proof-of-concept code does not guarantee safety .
4. Verify patch application in staging environments before rolling to production, especially for ColdFusion where the fix may affect custom applications.