Adobe Patches 140 Vulnerabilities Across 10 Products

Adobe patched roughly 140 vulnerabilities spanning 10 products, including critical and high-severity flaws. ColdFusion updates fixed 32 vulnerabilities including critical code execution and privilege escalation bugs. Content Credentials SDK had 30 vulnerabilities, many allowing security feature bypass or denial of service. Photoshop had 18 vulnerabilities mostly allowing arbitrary code execution. Substance 3D Stager had 16 vulnerabilities including high-severity code execution flaws. Commerce had 11 vulnerabilities, some exploitable without authentication for code execution or privilege escalation. Other products such as FrameMaker, Dimension, Substance 3D Sampler, Substance 3D Designer, and Bridge also had multiple arbitrary code execution vulnerabilities fixed. Adobe is unaware of active exploitation and rates most vulnerabilities as priority 3, with Commerce at priority 2. AI models assist Adobe in vulnerability discovery, with human review before deployment.

The vulnerabilities affect multiple Adobe products and include critical risks such as arbitrary code execution, privilege escalation, security feature bypass, and denial of service. Exploitation could allow attackers to execute code, escalate privileges, bypass security controls, or disrupt services. However, Adobe reports no known active exploitation in the wild. The Commerce product is considered higher risk due to historical targeting by threat actors.

Adobe has released official patches addressing these vulnerabilities across the affected products. Users and administrators should apply the latest security updates from Adobe promptly. Since Adobe is not aware of any in-the-wild exploitation and has assigned mostly priority 3 ratings, immediate emergency response is not indicated, but timely patching is recommended. Check Adobe's official security advisories for detailed patch information and update schedules.