cyber.hendryadrian.com
Security News · securityweek.com

Adobe Patches 170+ Flaws, Including Exploited Commerce Zero-Day

· Original article ↗

Summary

Adobe patched more than 170 flaws across its products. The Commerce/Magento zero-day CVE-2026-75650 is being exploited for remote code execution; Adobe urges prompt updates and recommends rotating affected encryption keys and credentials.

Key points

  • Adobe says CVE-2026-75650, a critical unauthenticated code-injection flaw in Commerce and Magento Open Source, is exploited in the wild and enables remote code execution.
  • Sansec reports exploitation began September 4 under the name StyleSmuggler, using Magento’s Payment Transaction Failed Reminder to trigger injected code.
  • Sansec says multiple threat actors have targeted the flaw to deploy backdoors and web shells.
  • Adobe released eight additional Commerce patches, including two critical privilege-escalation flaws and six high-severity security-bypass or privilege-escalation flaws.
  • Adobe also issued urgent patches for a critical Campaign Classic OS command-injection flaw and priority 1 ColdFusion updates addressing two critical code-execution issues and seven high- or medium-severity flaws.
  • Adobe fixed 107 Experience Manager vulnerabilities, 32 in Acrobat Reader, eight in Photoshop, three in Illustrator, and one in Animate, as well as issues in Photoshop Mobile.
  • Adobe recommends applying priority 1 updates within three days. Sansec advises rotating encryption keys and credentials protected by them at their source.

Article Details

Event Type
Adobe security updates addressing more than 170 vulnerabilities across its products, including an actively exploited zero-day in Adobe Commerce and Magento Open Source.
Impact
CVE-2026-75650 is an unauthenticated code injection flaw enabling remote code execution. Attackers have exploited it since September 4 to inject code and deploy backdoors and web shells against online stores. Adobe also patched other critical and high-severity vulnerabilities, including code execution flaws in Campaign Classic and ColdFusion. Adobe reported no known exploitation of the other newly resolved vulnerabilities.

CVE

CVE-2026-48273a priority 1 rating, as they address two critical-severity code execution security weaknesses: CVE-2026-48273 (CVSS score of 9.9/10) and CVE-2026-75746 (CVSS score of 9.1/10), and seven high- and medium-severityCVE-2026-75650Tracked as CVE-2026-75650 (CVSS score of 10/10), the flaw is a code injection issue that can be exploited without authentication for remote code execution (RCE).CVE-2026-75746two critical-severity code execution security weaknesses: CVE-2026-48273 (CVSS score of 9.9/10) and CVE-2026-75746 (CVSS score of 9.1/10), and seven high- and medium-severity issues.CVE-2026-82004The company also released urgent patches for CVE-2026-82004 (CVSS score of 10/10), an OS command injection defect in Campaign Classic leading to arbitrary code execution.

Vendors

AdobeAdobe has released patches for more than 170 vulnerabilities across its products, including urgent hotfixes for a critical-severity flaw in Adobe Commerce and Magento Open Source that has been exploited in the wild as a

Products

Adobe Acrobat ReaderOn Tuesday, Adobe also rolled out fixes for 107 vulnerabilities in Experience Manager, 32 flaws in Acrobat Reader, 8 in Photoshop, 3 in Illustrator, and 1 in Animate.Adobe ColdFusionFresh ColdFusion security updates were also assigned a priority 1 rating, as they address two critical-severity code execution security weaknesses: CVE-2026-48273 (CVSS score of 9.9/10) and CVE-2026-75746 (CVSS score ofAdobe Commerce170 vulnerabilities across its products, including urgent hotfixes for a critical-severity flaw in Adobe Commerce and Magento Open Source that has been exploited in the wild as a zero-day.AnimateOn Tuesday, Adobe also rolled out fixes for 107 vulnerabilities in Experience Manager, 32 flaws in Acrobat Reader, 8 in Photoshop, 3 in Illustrator, and 1 in Animate.Campaign ClassicThe company also released urgent patches for CVE-2026-82004 (CVSS score of 10/10), an OS command injection defect in Campaign Classic leading to arbitrary code execution.Experience ManagerOn Tuesday, Adobe also rolled out fixes for 107 vulnerabilities in Experience Manager, 32 flaws in Acrobat Reader, 8 in Photoshop, 3 in Illustrator, and 1 in Animate.IllustratorOn Tuesday, Adobe also rolled out fixes for 107 vulnerabilities in Experience Manager, 32 flaws in Acrobat Reader, 8 in Photoshop, 3 in Illustrator, and 1 in Animate.Magentoacross its products, including urgent hotfixes for a critical-severity flaw in Adobe Commerce and Magento Open Source that has been exploited in the wild as a zero-day.PhotoshopOn Tuesday, Adobe also rolled out fixes for 107 vulnerabilities in Experience Manager, 32 flaws in Acrobat Reader, 8 in Photoshop, 3 in Illustrator, and 1 in Animate.Photoshop MobileFixes were also rolled out for Photoshop Mobile.

Related Articles