Adobe Patches 140 Vulnerabilities Across 10 Products, Including Critical Flaws
Adobe has released significant security updates addressing 140 vulnerabilities across 10 of its products, with critical flaws found in Adobe Commerce and ColdFusion.
Adobe has issued a substantial wave of security updates, patching a total of 140 vulnerabilities across ten of its software products. The advisories cover a wide range of Adobe's offerings, including critical applications like Commerce, ColdFusion, and Photoshop, as well as tools such as Substance 3D, Dimension, FrameMaker, and Bridge.
The most severe issues were identified in Adobe ColdFusion, where 32 vulnerabilities were addressed. Among these are critical flaws that could be exploited for remote code execution and privilege escalation, posing a significant risk to users.
Adobe's Content Credentials SDK also received fixes for 30 vulnerabilities, many of which are described as high-severity and could lead to a security feature bypass or denial-of-service conditions. Furthermore, Adobe Photoshop users should be aware of 18 patched vulnerabilities, with nearly all of them allowing for arbitrary code execution.
Other affected products include Substance 3D Stager, which had 16 vulnerabilities fixed, including numerous high-severity arbitrary code execution flaws. Adobe Commerce users should note eleven patched vulnerabilities, several of which are critical and could be exploited without authentication to achieve code execution or escalate privileges.
Additional updates address multiple vulnerabilities in FrameMaker, Dimension, Substance 3D Sampler, Substance 3D Designer, and Bridge, many of which also permit arbitrary code execution. While Adobe states it is unaware of any in-the-wild exploitation for most of these flaws, the Adobe Commerce product is noted as having a priority rating of 2, indicating a historical target for threat actors.
This large volume of patches is partly attributed to Adobe's increased use of advanced AI models in its internal security testing to proactively hunt for flaws. However, the company continues to rely on external researchers for many of the discoveries.
To manage the increased pace of vulnerability disclosures, Adobe has shifted from monthly to twice-monthly security bulletin releases, occurring on the second and fourth Tuesday of each month.
Users are strongly advised to apply these updates promptly to mitigate the risks associated with these newly patched vulnerabilities, especially given the critical nature of some flaws in widely used products like ColdFusion and Commerce.