widely-deployed-product-advisoryinternet-facing-service-vulnerabilityendpoint-software-vulnerabilityprivilege-escalation-technique

Adobe Patches Critical RCE Flaws in FrameMaker Publishing, Commerce, and Magento

Patch & Detection Intelligence · 2 sources · Updated 4mo ago · First seen Apr 14, 2026

Adobe released security updates for multiple critical vulnerabilities affecting Adobe FrameMaker Publishing Server, Adobe Commerce, Magento Open Source, and the Adobe Commerce Webhooks extension. The most serious issues include CVE-2024-30299 and CVE-2024-30300 in FrameMaker Publishing Server and CVE-2024-34102 in Adobe Commerce and Magento, with severity reaching CVSS 10.0. Successful exploitation could allow arbitrary code execution, security feature bypass, and privilege escalation.

Adobe also issued critical fixes for Adobe Experience Manager, Creative Cloud Desktop, Photoshop, and Substance 3D Stager to address vulnerabilities that could enable code execution, unauthorized system access, and exposure of sensitive data. National cybersecurity authorities highlighted the breadth and severity of the flaws and urged organizations using affected Adobe products to apply vendor patches immediately in line with Adobe guidance.

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Jun 13, 2024

Jun 13, 20242y ago
Adobe publishes additional critical updates across other product lines
Alongside the above fixes, Adobe also released critical security updates for Adobe Experience Manager, Adobe Creative Cloud Desktop, Adobe Photoshop, and Adobe Substance 3D Stager. These updates addressed vulnerabilities that could allow code execution, system access, or unauthorized access to data.
Jun 13, 20242y ago
Adobe releases critical patches for FrameMaker, Commerce, and Magento
Adobe issued security updates for Adobe FrameMaker Publishing Server, Adobe Commerce, Magento Open Source, and the Adobe Commerce Webhooks extension to fix multiple critical vulnerabilities. The flaws included CVE-2024-30299 and CVE-2024-30300 in FrameMaker Publishing Server and CVE-2024-34102 in Adobe Commerce and Magento, with potential impacts including remote code execution, security feature bypass, and privilege escalation.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

3 linked

CosmicSting (CVE-2024-34102)Improper Authentication Privilege Escalation in Adobe FrameMaker Publishing Server (CVE-2024-30299)Information Exposure Privilege Escalation in Adobe FrameMaker Publishing Server (CVE-2024-30300)

Affected products

2 linked

Magento Open SourceAdobe Commerce

Organizations

1 linked

Adobe

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Kyberturvallisuuskeskus AlertsNews · Jun 13, 2024

Kriittisiä haavoittuvuuksia Adobe FrameMaker Publishing, Adobe Commerce ja Magento alustoissa | TraficomOpen source ↗

Kyberturvallisuuskeskus AlertsNews · Jun 13, 2024

Kriittisiä haavoittuvuuksia Adobe FrameMaker Publishing, Adobe Commerce ja Magento alustoissa | TraficomOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Adobe Patches Critical RCE Flaws in FrameMaker Publishing, Commerce, and Magento

How this story unfolded

Adobe publishes additional critical updates across other product lines

Adobe releases critical patches for FrameMaker, Commerce, and Magento

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Adobe fixes 48 flaws across Creative Cloud apps and Commerce, including critical RCE

Adobe fixes 252 flaws across Experience Manager, Commerce, InDesign and other products

Adobe Patches Critical Flaws Across ColdFusion, Experience Manager, Animate, and Commerce

Adobe Patches Critical RCE Flaws in FrameMaker Publishing, Commerce, and Magento

How this story unfolded

Adobe publishes additional critical updates across other product lines

Adobe releases critical patches for FrameMaker, Commerce, and Magento

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Adobe fixes 48 flaws across Creative Cloud apps and Commerce, including critical RCE

Adobe fixes 252 flaws across Experience Manager, Commerce, InDesign and other products

Adobe Patches Critical Flaws Across ColdFusion, Experience Manager, Animate, and Commerce