What you need to know today.

Adobe is facing a significant security challenge with multiple critical vulnerabilities disclosed across its ColdFusion and Campaign Classic (ACC) products. The most severe, CVE-2026-48282, a path traversal flaw in ColdFusion, carries a CVSS score of 10.0 and is already listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation. This vulnerability, along with others in ColdFusion such as CVE-2026-48362 (OS Command Injection) and CVE-2026-48283 (Unrestricted Upload), could lead to arbitrary code execution. Adobe Campaign Classic is also heavily impacted, with numerous critical vulnerabilities including OS Command Injection (CVE-2026-76197, CVE-2026-76195), SSRF (CVE-2026-76193, CVE-2026-48331), SQL Injection (CVE-2026-48330), and authorization bypasses (CVE-2026-71398, CVE-2026-27302, CVE-2026-48449, CVE-2026-48286), all potentially leading to arbitrary code execution. The sheer volume and critical nature of these flaws, many with CVSS 10.0 scores, necessitate immediate patching for all affected Adobe customers. As reported by The Hacker News, Adobe has released patches for these critical issues.

A critical authentication bypass vulnerability in ownCloud (CVE-2023-49105) has been actively exploited, allowing unauthenticated attackers to access, modify, or delete any file if the username is known and no signing-key is configured. This flaw has been notably used to steal nuclear and naval data from the Philippines, as reported by Cyber Security News. CISA has added this vulnerability to its KEV catalog, urging federal agencies to patch it immediately. The exploitability of this vulnerability, even without authentication, makes it a high-priority target for attackers seeking sensitive data.

WordPress users should be aware of a critical deserialization vulnerability in the GiveWP plugin (CVE-2026-82222). This flaw allows for object injection, potentially leading to remote code execution on affected sites. The vulnerability affects GiveWP versions up to 4.16.7.1. As detailed by Patchstack Blog, the exploit does not require authentication, increasing the risk for website owners. Promptly updating the GiveWP plugin is crucial to mitigate this risk.

Adobe Acrobat Reader is also affected by a critical Prototype Pollution vulnerability (CVE-2026-34621) that could lead to arbitrary code execution. This flaw impacts versions up to 24.001.30356 and 26.001.21367. While not yet on the KEV catalog, its critical severity and potential for code execution warrant attention. BleepingComputer notes that CISA has ordered federal agencies to patch a similar critical ColdFusion flaw, highlighting Adobe's ongoing security challenges.

A critical vulnerability in TOTOLINK N600R routers (CVE-2026-79911) allows for arbitrary code execution through manipulation of the Hostname argument in the CGI handler. This type of vulnerability in network devices can be a gateway for attackers to compromise entire networks, especially in small to medium-sized businesses that may not have robust security monitoring. The CVSS 10.0 score indicates a severe risk, and users of this device should seek updated firmware or alternative solutions.

SIMULIA Execution Engine users should address a critical deserialization vulnerability (CVE-2026-17061) that could lead to unauthenticated remote code execution. This flaw affects releases from 2023 through 2026, posing a significant risk to organizations relying on this software for simulation and execution management. The unauthenticated nature of the exploit makes it particularly dangerous.