Adobe released patches for three vulnerabilities scoring 10.0 on the CVSS scale in January 2025. Two affected ColdFusion (CVE-2026-48362 and CVE-2026-71398), and one hit Campaign Classic. Within days, Sansec reported active exploitation of CVE-2026-71362 in Adobe Commerce, where attackers switched customer sessions to steal data.
When you're running Adobe products, especially ColdFusion in customer-facing environments, these patches represent a race between your deployment pipeline and attackers scanning for unpatched instances.
Timeline
Day 0: Adobe published security advisories with Priority 1 ratings and recommended patching within 72 hours.
Day 0-3: Organizations with mature patch management processes began testing updates in staging environments.
Day 3-7: Sansec observed exploitation of the Commerce vulnerability in production environments. Attackers used session manipulation to access customer accounts without credentials.
Day 7+: Organizations still identifying affected systems, scheduling maintenance windows, and coordinating with business stakeholders remained vulnerable.
The 72-hour window Adobe recommended wasn't arbitrary. It reflected the typical time between public disclosure and widespread exploitation attempts.
Which Controls Failed or Were Missing
Asset inventory failures: Teams couldn't patch systems they didn't know existed. ColdFusion often runs on legacy infrastructure that predates current asset management systems. Without a complete inventory of web-facing applications and their underlying platforms, you can't respond to a Priority 1 advisory in 72 hours.
Patch testing bottlenecks: Organizations that require full regression testing before any production deployment couldn't meet the 72-hour target. When your test cycle takes two weeks, a critical vulnerability forces you to choose between security risk and process deviation.
Deployment complexity: The Campaign Classic update only applied to on-premise deployments and on-premise components of hybrid deployments. Teams managing hybrid environments needed different procedures for different components, adding coordination overhead during an already compressed timeline.
Monitoring gaps: The exploitation Sansec reported involved session manipulation. Organizations without session integrity monitoring or anomalous authentication pattern detection wouldn't notice the attack until customer complaints surfaced.
What the Relevant Standards Require
PCI DSS v4.0.1 Requirement 6.3.1 states: "Security vulnerabilities are identified and addressed as follows: New security vulnerabilities are identified using industry-recognized sources for security vulnerability information." The requirement doesn't specify a timeline, but Requirement 6.3.1.1 adds: "Critical or high security vulnerabilities are addressed by installing relevant security patches within one month of release."
One month is your outer boundary for PCI compliance. Adobe's 72-hour recommendation reflects the actual threat landscape for CVSS 10.0 vulnerabilities, not the compliance minimum.
NIST 800-53 Rev 5 SI-2 (Flaw Remediation) requires organizations to install security-relevant software updates within organization-defined time periods. The control enhancement SI-2(2) specifies automated flaw remediation status. If you're subject to NIST 800-53, you should have defined your remediation timeline for critical vulnerabilities before Adobe's advisory landed.
ISO 27001 Annex A.8.8 (Management of Technical Vulnerabilities) requires timely information about technical vulnerabilities, evaluation of exposure, and appropriate measures in response. "Timely" means you need a process that matches the vulnerability severity to your response speed.
The standards set floors, not ceilings. A CVSS 10.0 vulnerability with active exploitation demands faster action than your policy minimum.
Lessons and Action Items for Your Team
Build a 72-hour emergency patch capability: Your standard change management process should have an express lane for critical vulnerabilities. Define who can approve emergency changes, what testing is mandatory versus optional, and how you'll communicate with stakeholders. Document this before the next Priority 1 advisory arrives.
Maintain an application platform inventory: Create a database that maps every web-facing application to its underlying platform, version, and deployment model (cloud-hosted, on-premise, hybrid). Update it when you deploy new applications, not when Adobe releases an advisory. Include the business owner and technical contact for each system.
Separate patch testing from regression testing: For critical vulnerabilities, you need to verify the patch doesn't break core functionality. You don't need to verify every edge case in your application. Define a smoke test suite that runs in under four hours and covers authentication, data access, and critical business workflows.
Deploy session integrity monitoring: If you're running Adobe Commerce or any e-commerce platform, monitor for session anomalies: session IDs appearing from multiple IP addresses, session creation patterns that don't match user behavior, or privilege escalations within a session. These indicators would have flagged the exploitation Sansec observed.
Automate patch availability notifications: Configure your vulnerability management platform to alert on new CVEs affecting your technology stack. Don't wait for someone to manually check vendor advisories. Adobe published these fixes on a Tuesday; your team should have known by Tuesday afternoon.
Test your hybrid deployment procedures: If you run hybrid environments with both cloud-hosted and on-premise components, practice coordinating updates across both. The Campaign Classic update requirements showed how hybrid deployments complicate patch management. Your runbooks should account for this complexity.
Define your CVSS response matrix: Document your expected response times for different CVSS score ranges. For example: CVSS 9.0-10.0 requires emergency patching within 72 hours, 7.0-8.9 within one week, below 7.0 within 30 days. Share this matrix with your change advisory board so everyone understands why you're requesting an emergency change.
When Adobe says "install within 72 hours," they're telling you that exploitation is imminent or already happening. Your patch management process needs to match that reality, not just satisfy the compliance checkbox.
