Adobe Patches About 140 Vulnerabilities Across 10 Products
Summary
Adobe issued 10 security advisories patching about 140 vulnerabilities across 10 products. The company reports no known in-the-wild exploitation and says AI-assisted flaw discovery contributed to the higher volume of fixes.
Key points
- ColdFusion received fixes for 32 vulnerabilities, including critical flaws that could enable code execution or privilege escalation.
- Content Credentials SDK had 30 vulnerabilities fixed, including high-severity security-feature bypass and denial-of-service flaws.
- Photoshop received fixes for 18 vulnerabilities, nearly all of which could allow arbitrary code execution; Substance 3D Stager had 16 fixes, including high-severity code-execution flaws.
- Adobe Commerce had 11 vulnerabilities fixed, including critical unauthenticated code-execution or privilege-escalation flaws.
- Adobe says it is unaware of exploitation in the wild. Most advisories have priority 3; Commerce is rated priority 2 because threat actors have historically targeted it.
- Adobe says frontier AI models helped identify flaws, while engineers review and approve AI-assisted code changes.
- Adobe has shifted from monthly security bulletins to a schedule of the second and fourth Tuesday of each month.
Article Details
- Vulnerability Types
- Code execution
- Privilege escalation
- Security feature bypass
- Denial of service
- Severity
- Critical and high
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
Vendors
Products
Adobe ColdFusionAdobe ColdFusion updates address 32 vulnerabilities, including critical bugs that can be exploited for code execution and privilege escalation.Adobe CommerceEleven vulnerabilities have been resolved in Adobe Commerce, including several critical issues that can be exploited without authentication to execute code or escalate privileges.BridgeSeveral vulnerabilities that allow arbitrary code execution have been fixed in each of the following products: FrameMaker, Dimension, Substance 3D Sampler, Substance 3D Designer, and Bridge.Content Credentials SDKA significant number of flaws have been patched by Adobe in the Content Credentials SDK.DimensionSeveral vulnerabilities that allow arbitrary code execution have been fixed in each of the following products: FrameMaker, Dimension, Substance 3D Sampler, Substance 3D Designer, and Bridge.FrameMakerSeveral vulnerabilities that allow arbitrary code execution have been fixed in each of the following products: FrameMaker, Dimension, Substance 3D Sampler, Substance 3D Designer, and Bridge.PhotoshopAdobe patched 18 vulnerabilities in Photoshop, nearly all allowing arbitrary code execution.Substance 3D DesignerSeveral vulnerabilities that allow arbitrary code execution have been fixed in each of the following products: FrameMaker, Dimension, Substance 3D Sampler, Substance 3D Designer, and Bridge.Substance 3D SamplerSeveral vulnerabilities that allow arbitrary code execution have been fixed in each of the following products: FrameMaker, Dimension, Substance 3D Sampler, Substance 3D Designer, and Bridge.Substance 3D StagerIn Substance 3D Stager, Adobe fixed 16 vulnerabilities, including many high-severity arbitrary code execution flaws.