Adobe Patches 55 Vulnerabilities Across 11 Products
Summary
Adobe patched 55 vulnerabilities across 11 products. Five critical ColdFusion flaws can bypass security features, read files or execute code; Adobe says it is unaware of in-the-wild exploitation of the patched flaws.
Key points
- Adobe released 11 advisories covering 55 vulnerabilities across its products.
- Five critical ColdFusion flaws can bypass security features, read system files and execute arbitrary code; Adobe assigned their advisory priority 1.
- Critical code-execution flaws were also patched in Acrobat Reader, InDesign, InCopy, FrameMaker, Connect, Bridge, Photoshop and Illustrator.
- Experience Manager Screens and DNG SDK updates address important-severity issues including code execution, denial of service and privilege escalation.
- Adobe says it is unaware of in-the-wild exploitation of the vulnerabilities in these updates.
- The article separately notes a recently patched Acrobat and Reader zero-day, CVE-2026-34621, that appears to have been exploited for months, and CISA's warning about attacks exploiting CVE-2020-9715.
Article Details
- Event Type
- Adobe security patch release
- Impact
- Adobe patched 55 vulnerabilities across 11 products. The ColdFusion advisory covers five critical vulnerabilities that could bypass security features, read system files, or execute arbitrary code; critical code-execution issues were also patched in several other products. Adobe reported no known in-the-wild exploitation of the vulnerabilities in these latest updates. Separately, CVE-2026-34621 was reported as an Acrobat and Reader zero-day that appeared to have been exploited for several months, and CISA warned of attacks exploiting CVE-2020-9715.
CVE
CVE-2020-9715Vendor / Product unavailableIn addition, CISA warned on Monday that it’s aware of attacks exploiting an old Acrobat and Reader vulnerability tracked as CVE-2020-9715.CVE-2026-34621Adobe · Acrobat 2024; Adobe · Acrobat DC; +1 moreHowever, a few days ago Adobe announced patches for CVE-2026-34621, an Acrobat and Reader zero-day that appears to have been exploited for several months.
Vendors
Products
Adobe Acrobat ReaderCritical code execution vulnerabilities have also been patched in Acrobat Reader, InDesign, InCopy, FrameMaker, Connect, Bridge, Photoshop, and Illustrator.Adobe ColdFusionHowever, an advisory describing five critical ColdFusion vulnerabilities has a priority rating of 1, indicating that companies should prioritize patching because the product has historically been targeted by threatAdobe InDesignCritical code execution vulnerabilities have also been patched in Acrobat Reader, InDesign, InCopy, FrameMaker, Connect, Bridge, Photoshop, and Illustrator.BridgeCritical code execution vulnerabilities have also been patched in Acrobat Reader, InDesign, InCopy, FrameMaker, Connect, Bridge, Photoshop, and Illustrator.ConnectCritical code execution vulnerabilities have also been patched in Acrobat Reader, InDesign, InCopy, FrameMaker, Connect, Bridge, Photoshop, and Illustrator.DNG SDKImportant-severity issues — including ones allowing code execution, DoS attacks, and privilege escalation — were patched in Experience Manager Screens and the DNG SDK.Experience Manager ScreensImportant-severity issues — including ones allowing code execution, DoS attacks, and privilege escalation — were patched in Experience Manager Screens and the DNG SDK.FrameMakerCritical code execution vulnerabilities have also been patched in Acrobat Reader, InDesign, InCopy, FrameMaker, Connect, Bridge, Photoshop, and Illustrator.IllustratorCritical code execution vulnerabilities have also been patched in Acrobat Reader, InDesign, InCopy, FrameMaker, Connect, Bridge, Photoshop, and Illustrator.InCopyCritical code execution vulnerabilities have also been patched in Acrobat Reader, InDesign, InCopy, FrameMaker, Connect, Bridge, Photoshop, and Illustrator.PhotoshopCritical code execution vulnerabilities have also been patched in Acrobat Reader, InDesign, InCopy, FrameMaker, Connect, Bridge, Photoshop, and Illustrator.