cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Adobe Patches 88 Vulnerabilities Across 12 Products, Including Critical ColdFusion Flaws

· Original article ↗

Summary

Adobe patched 88 vulnerabilities across 12 products, including critical flaws in ColdFusion, Commerce, Experience Manager and Illustrator. Adobe says it is unaware of exploitation of these flaws and urges customers to apply the updates.

Key points

  • Adobe’s updates address 88 vulnerabilities across 12 products, with critical-severity flaws in ColdFusion, Commerce, Experience Manager and Illustrator.
  • Eight of ColdFusion’s 13 fixed defects could enable arbitrary code execution or privilege escalation; Adobe rates the advisory priority 1.
  • ColdFusion 2025 update 11 and ColdFusion 2023 update 22 fix the reported ColdFusion vulnerabilities.
  • Critical Commerce flaws CVE-2026-48356 and CVE-2026-48358 could enable privilege escalation or arbitrary code execution.
  • Critical Experience Manager flaws CVE-2026-48259 and CVE-2026-48359 could enable arbitrary code execution.
  • Adobe says it is not aware of any of the vulnerabilities in this update being exploited in the wild.
  • Two weeks earlier, Adobe patched six maximum-severity ColdFusion flaws; the article says one was exploited within hours of public disclosure.

Article Details

Vulnerability Types
  • Path traversal
  • Code injection
  • Improper input validation
  • Missing authentication
  • SQL injection
  • Incorrect authorization
Severity
Critical
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-48259The fresh update for Experience Manager also patches 13 security defects, including two critical bugs, tracked as CVE-2026-48259 and CVE-2026-48359.CVE-2026-48284Out of 13 security defects resolved in ColdFusion, eight – CVE-2026-48318, CVE-2026-48322, CVE-2026-48284, CVE-2026-48321, CVE-2026-48325, CVE-2026-48319, CVE-2026-48324, and CVE-2026-48327 – are critical issues thatCVE-2026-48318Out of 13 security defects resolved in ColdFusion, eight – CVE-2026-48318, CVE-2026-48322, CVE-2026-48284, CVE-2026-48321, CVE-2026-48325, CVE-2026-48319, CVE-2026-48324, and CVE-2026-48327 – are critical issues thatCVE-2026-48319ColdFusion, eight – CVE-2026-48318, CVE-2026-48322, CVE-2026-48284, CVE-2026-48321, CVE-2026-48325, CVE-2026-48319, CVE-2026-48324, and CVE-2026-48327 – are critical issues that could lead to arbitrary code executionCVE-2026-4832113 security defects resolved in ColdFusion, eight – CVE-2026-48318, CVE-2026-48322, CVE-2026-48284, CVE-2026-48321, CVE-2026-48325, CVE-2026-48319, CVE-2026-48324, and CVE-2026-48327 – are critical issues that couldCVE-2026-48322Out of 13 security defects resolved in ColdFusion, eight – CVE-2026-48318, CVE-2026-48322, CVE-2026-48284, CVE-2026-48321, CVE-2026-48325, CVE-2026-48319, CVE-2026-48324, and CVE-2026-48327 – are critical issues thatCVE-2026-48324– CVE-2026-48318, CVE-2026-48322, CVE-2026-48284, CVE-2026-48321, CVE-2026-48325, CVE-2026-48319, CVE-2026-48324, and CVE-2026-48327 – are critical issues that could lead to arbitrary code execution and privilegeCVE-2026-48325resolved in ColdFusion, eight – CVE-2026-48318, CVE-2026-48322, CVE-2026-48284, CVE-2026-48321, CVE-2026-48325, CVE-2026-48319, CVE-2026-48324, and CVE-2026-48327 – are critical issues that could lead toCVE-2026-48327CVE-2026-48322, CVE-2026-48284, CVE-2026-48321, CVE-2026-48325, CVE-2026-48319, CVE-2026-48324, and CVE-2026-48327 – are critical issues that could lead to arbitrary code execution and privilege escalation.CVE-2026-48334Tracked as CVE-2026-48334 and described as improper input validation, the critical flaw could be exploited for privilege escalation.CVE-2026-48356On Tuesday, Adobe also resolved 13 vulnerabilities in Commerce, including two critical-severity bugs. Tracked as CVE-2026-48356 and CVE-2026-48358, they could lead to privilege escalation and arbitrary code execution.CVE-2026-48358On Tuesday, Adobe also resolved 13 vulnerabilities in Commerce, including two critical-severity bugs. Tracked as CVE-2026-48356 and CVE-2026-48358, they could lead to privilege escalation and arbitrary code execution.CVE-2026-48359The fresh update for Experience Manager also patches 13 security defects, including two critical bugs, tracked as CVE-2026-48259 and CVE-2026-48359.

Vendors

AdobeAdobe on Tuesday rolled out security updates for 12 products to address 88 vulnerabilities, including critical-severity bugs in ColdFusion, Commerce, Experience Manager, and Illustrator.

Products

Adobe ColdFusionAdobe on Tuesday rolled out security updates for 12 products to address 88 vulnerabilities, including critical-severity bugs in ColdFusion, Commerce, Experience Manager, and Illustrator.Adobe CommerceAdobe on Tuesday rolled out security updates for 12 products to address 88 vulnerabilities, including critical-severity bugs in ColdFusion, Commerce, Experience Manager, and Illustrator.Experience ManagerAdobe on Tuesday rolled out security updates for 12 products to address 88 vulnerabilities, including critical-severity bugs in ColdFusion, Commerce, Experience Manager, and Illustrator.IllustratorAdobe on Tuesday rolled out security updates for 12 products to address 88 vulnerabilities, including critical-severity bugs in ColdFusion, Commerce, Experience Manager, and Illustrator.

Related Articles