Adobe on Tuesday rolled out security updates for 12 products to address 88 vulnerabilities, including critical-severity bugs in ColdFusion, Commerce, Experience Manager, and Illustrator.
Out of 13 security defects resolved in ColdFusion, eight – CVE-2026-48318, CVE-2026-48322, CVE-2026-48284, CVE-2026-48321, CVE-2026-48325, CVE-2026-48319, CVE-2026-48324, and CVE-2026-48327 – are critical issues that could lead to arbitrary code execution and privilege escalation.
The critical vulnerabilities include path traversal, code injection, improper input validation, missing authentication, SQL injection, and incorrect authorization.
Adobe’s fresh advisory has a priority 1 rating, meaning that customers should apply the patches as soon as possible. ColdFusion 2025 update 11 and ColdFusion 2023 update 22 resolve all the bugs.
The fresh patches come only two weeks after Adobe patched six maximum-severity weaknesses in ColdFusion, including one that hackers started exploiting in attacks within hours of public disclosure.
On Tuesday, Adobe also resolved 13 vulnerabilities in Commerce, including two critical-severity bugs. Tracked as CVE-2026-48356 and CVE-2026-48358, they could lead to privilege escalation and arbitrary code execution.
The fresh update for Experience Manager also patches 13 security defects, including two critical bugs, tracked as CVE-2026-48259 and CVE-2026-48359. Both can be exploited for arbitrary code execution.
Another critical issue was resolved in Illustrator, along with four other weaknesses. Tracked as CVE-2026-48334 and described as improper input validation, the critical flaw could be exploited for privilege escalation.
On Tuesday, Adobe also announced updates for Content Credentials SDK (12 vulnerabilities), Animate (6 flaws), Audition (6), Bridge (6), Media Encoder (5), Premiere Pro (4), After Effects (3), and Creative Cloud Desktop Application (2).
Adobe says it is not aware of any of these vulnerabilities being exploited in the wild. Users are advised to apply the patches as soon as possible. Additional information can be found on Adobe’s security bulletins page.
Microsoft’s latest Patch Tuesday updates fix a record-breaking 622 flaws, including two actively exploited zero-days.
Related: 7 Severe Vulnerabilities Patched in VMware Avi Load Balancer
Related: SAP Patches Critical Vulnerabilities in NetWeaver, Approuter, Commerce Cloud
Related: RabbitMQ Vulnerability Threatens Enterprise Systems
Related: Organizations Warned of Exploited Joomla Extension Vulnerabilities
