Adobe has released patches for three critical vulnerabilities in ColdFusion and Campaign Classic, including a CVSS 10.0 flaw that could allow arbitrary code execution and privilege escalation. The most severe vulnerability, CVE-2026-48362, is an operating system command injection flaw in ColdFusion with a perfect CVSS score, indicating a high likelihood of exploitation1. If successfully exploited, this vulnerability could grant attackers full control over affected systems. The updates also address vulnerabilities in Commerce and Campaign Classic, which could be used to gain elevated privileges. Administrators are advised to prioritize patching based on their exposure and evidence of exploitation. The disclosure of CVE-2026-48362 expands the active attack surface, making it essential for practitioners to take immediate action to protect their systems. So what matters most to security teams is the urgent need to apply these patches to prevent potential attacks.