adobe just patched THREE perfect 10/10 security bugs on the same day — and that many at once isn't normal

Adobe's August 2026 Patch Tuesday round shipped six new vulnerabilities across ColdFusion and Campaign Classic — and three of them score a perfect, maximum-possible 10.0 on the CVSS scale. All three need no password, no user click, and no special access: send the right request to an exposed server and you own it. If you run either product and haven't patched since August 11, read the fix table below and go do that first.

Six bugs, but three matter more than the rest

"Incorrect authorization" sounds bureaucratic, but in Campaign Classic it means the server never properly checks who's allowed to do what — so a remote, unauthenticated request can act as if it came from an administrator. No stolen password required, because none was ever checked in the first place.

CVE-2026-48362 is uglier still: OS command injection means attacker-controlled input reaches a system shell call unsanitized, handing over code execution on the server itself, not just the application running on it. That's the difference between defacing a website and owning the box that hosts it.

Why three perfect 10s in one batch is the real story

A CVSS 10.0 requires a network attack vector, zero privileges, zero user interaction, and maximum impact across confidentiality, integrity and availability all at once. Historically that's a rare combination for a single bug — seeing three land together, across two different codebases, in one disclosure cycle is unusual enough to be its own story.

The fix, and the one you might be missing

Adobe shipped a seventh, unrelated fix the same day for Commerce — CVE-2026-71362, which, unlike these three, is already being exploited to hijack customer accounts according to Sansec. If you run any Adobe server product, patching ColdFusion or Campaign Classic doesn't cover you there. Check all three product lines separately, not as one bucket.

Adobe's pattern this year has been to ship a cluster of critical fixes almost every Patch Tuesday. We covered Cisco's own triple-9.9 cluster in Catalyst SD-WAN just weeks ago, and the Citrix NetScaler SAML flaw before that. My honest read: 2026 is the year "multiple perfect-10s in one disclosure" stopped being rare, and the right response for any admin is to stop treating Patch Tuesday as a monthly chore and start treating it as a weekly habit of checking what shipped.