July 2026 Patch Tuesday
Patch Tuesday Watch: What Led Up to July 2026 Adobe Release date: June 30, 2026 (APSB26-68 — ColdFusion; same-day bulletin for Campaign Classic) CVE count: 11 CVEs in ColdFusion, 1 in Campaign Classic (12 total) Adobe's ColdFusion update resolved 11 vulnerabilities across ColdFusion 2025 (Update 9 and earlier) and ColdFusion 2023 (Update 20 and earlier), including seven rated CVSS 10.0: Fixed in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21. KEV callout: CVE-2026-48282 was not flagged as exploited at release, but exploitation began within roughly two hours of a public technical writeup on July 2. CISA added it to KEV on July 7, with a federal remediation deadline of July 10 — alrea
Read at Ivanti security advisories (blog)
- Vendor
- Ivanti, Adobe
- Product
- ColdFusion
- CVSS
- 10.0
- Exploitation
- observed in the wild
- Fix
- available
- Exposure class
- Web platform
Why it ranks 79 (Critical)
- Exploitation observed in the wild
- CVSS 10.0 critical
- Product class: web platform
- Widely deployed vendor product (Ivanti)
- Covered by 4 independent sources
- Fix available
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Ivanti security advisories (blog) (ivanti.com)
- CVE-2026-48282 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-48286 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-13028 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-15112 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-15129 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.