Adobe's Patch Tuesday update fixed 123 vulnerabilities spanning 11 products. Experience Manager had 57 vulnerabilities patched, mostly cross-site scripting (XSS) flaws enabling arbitrary code execution, plus three improper input validation issues causing security feature bypass. Adobe Campaign Classic had two critical arbitrary code execution vulnerabilities with CVSS 10. ColdFusion had seven vulnerabilities including critical and high-severity issues allowing arbitrary code execution, privilege escalation, and security bypass. Acrobat and Reader for Windows and macOS had 20 vulnerabilities including code execution, denial of service, and memory exposure. Other products like Dreamweaver, Format Plugins, Experience Manager Forms, InDesign, InCopy, and Substance 3D Sampler also received patches for critical and high-severity code execution issues. DoS flaws were fixed in Content Credentials SDK. Adobe assigned priority 1 to ColdFusion and Campaign Classic issues due to exploitation risk; other flaws have priority 3. No known exploits in the wild have been reported.

The vulnerabilities include multiple arbitrary code execution flaws, privilege escalation, security feature bypass, denial of service, and memory exposure issues across widely used Adobe products. Critical vulnerabilities with CVSS 10 exist in Campaign Classic and ColdFusion, which have been targeted by threat actors previously. Exploitation could allow attackers to execute code remotely, escalate privileges, or bypass security controls. However, Adobe currently reports no active exploitation in the wild for these vulnerabilities.

Adobe has released patches addressing all 123 vulnerabilities. Users and administrators should apply these official updates promptly to mitigate risk. Since this is not a cloud service, remediation depends on applying the patches. Adobe assigned priority 1 to ColdFusion and Campaign Classic vulnerabilities, indicating higher exploitation risk; these should be prioritized for patching. For other products, priority 3 indicates lower immediate risk but patching is still recommended. No additional vendor mitigation guidance or temporary fixes were provided.