Adobe is fixing a cluster of input-handling failures that can turn untrusted requests into server-side actions. The standard response is to treat this as a web bug, but the exposure sits deeper: uploads, paths, URL input, SSRF, and authorization checks can all become code execution, file access, or privilege escalation if they are trusted too early.
The patches cover ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21, plus Adobe Campaign Classic v7.4.3 build 9397. Adobe’s advisory and national CSIRT notices map the issues across multiple CVE classes, including unrestricted file upload, improper input validation, path traversal, reflected XSS, SSRF, and incorrect authorization, with seven flaws rated at maximum severity.
There is no public exploit signal in the sources, so this is a remediation story, not an incident response one. The forward risk is straightforward: any unpatched on-prem web app or admin backend that accepts files, paths, or server-side fetches can still be pushed from input parsing into control of the application tier.