Adobe Issues Critical Security Updates for ColdFusion Fixing Nine CVEs Including Eval Injection Flaws
Adobe has released security updates for Adobe ColdFusion to address nine vulnerabilities discovered in the platform, urging administrators to apply the patches as soon as possible.
The release was published on September 8, 2026, aligning with the monthly Patch Tuesday cycle. The fixes resolve multiple issues including dynamic code evaluation flaws and database query injection risks.
Among the addressed vulnerabilities are the Eval injection issue tracked as CVE-2026-48273 and the SQL injection vulnerability CVE-2026-75746. Six vulnerabilities received a Critical severity rating: CVE-2026-48273, CVE-2026-75746, CVE-2026-76190, CVE-2026-75993, CVE-2026-75999, and CVE-2026-75998.
According to the CVSSv3.1 scoring system, CVE-2026-48273 received the highest base score of 9.9, followed by CVE-2026-75746 at 9.1. The other four Critical issues scored between 8.6 and 7.5.
Three additional vulnerabilities classified as Important were also patched in the same update cycle.
Related articles
eBPF Verifier Discrepancy Revealed: PREVAIL Accepts Safe Code Rejected by Linux Kernel Verifier
Researchers discovered that the same BPF object file receives conflicting verdicts from different verifiers. The program correlated_branch.c from the ebpf-samples repository passes verification under PREVAIL but is rejected by the Linux kernel verifier. The divergence occurs because the kernel verifier tracks scalar bounds separately from packet pointer offsets, while PREVAIL maintains explicit links between checked packet sizes and pointer states. The XDP function ConvergedBranch performs a bounds check via check_packet before accessing an Ethernet header, yet the kernel verifier fails to propagate the guarantee to the subsequent load instruction. Replacing the helper call with an inline comparison against data_end allows the kernel verifier to accept the program. The finding highlights that verifier rejection does not always indicate an actual safety violation in eBPF code.
Critical ASUS Control Center Enterprise Flaw Allows Remote Root Access via CVE-2026-75754
A critical vulnerability identified as CVE-2026-75754 in ASUS Control Center Enterprise (ACC) carries a maximum CVSS score of 10.0 and enables unauthenticated remote attackers to gain full control of the management server and all connected devices. The flaw stems from a combination of missing authentication on a critical function, a server-side request forgery (SSRF) issue, and hardcoded credentials embedded directly in the software. Attackers can craft a malicious HTTP request to extract the system’s encryption key, activate an SSH service on TCP port 2222, and use fixed credentials to obtain a root shell without any user interaction. Once inside, the attacker can read, modify, or delete data stored in the ACC platform and propagate the compromise across managed servers, PCs, and workstations. All versions of ASUS Control Center Enterprise through 4.0.0.2 are affected. ASUS released a security advisory on September 4, 2026, urging immediate updates to mitigate the risk.
Critical Zero-Day 'StyleSmuggler' Vulnerability Exploited in Adobe Commerce and Magento
A zero-day vulnerability dubbed StyleSmuggler is being actively exploited in Magento Open Source and Adobe Commerce to achieve unauthenticated remote code execution and install backdoors on e-commerce servers. The flaw allows attackers to inject malicious PHP code into files generated by the platform and then force the template system to process it, with the attack chain triggered during the generation of default transaction failure emails. Exploitation has been observed since September 4 and works even if the email is not successfully sent. Researchers have reproduced the attack on clean installations of versions 2.4.7, 2.4.8, and 2.4.9, as well as on a fully patched Magento 2.4.6-p15 system. After compromise, a Rust-based implant is deployed outside the store directory, masquerading as the process [kworker/u:8:0] and maintained via a cron job that restarts it every five minutes. As of September 6, Adobe had not released a CVE, official patch, or specific workaround, though the next scheduled security update is set for September 8.
N-able Releases Hotfix 4 for Critical N-central RCE Flaw CVE-2026-86218 Now Confirmed Exploited
N-able disclosed a critical vulnerability in its N-central IT operations management platform that allows unauthenticated remote code execution on affected servers. The flaw, tracked as CVE-2026-86218, received the maximum CVSSv4.0 base score of 10.0 and is rated Critical. The company published security advisory information on September 5, 2026, and quickly followed with Hotfix 4 (version 2026.3.1.14) that resolves the issue. Although exploitation was not observed at disclosure, N-able updated the advisory the next day to confirm active exploitation in the wild. The vendor urges customers to apply the hotfix immediately and to monitor for suspicious account creation and scanning activity from specific IP addresses. Earlier hotfixes addressing CVE-2026-86206 and CVE-2026-86207 were superseded by the new release.