Adobe fixes critical flaws across Acrobat, ColdFusion, Experience Manager, and Campaign

Adobe released a broad set of security updates covering Adobe Experience Manager, Acrobat/Reader, ColdFusion, Dreamweaver, InDesign, InCopy, Substance 3D Sampler, Format Plugins, Campaign Classic, and Content Credentials SDK components, prompting alerts from national and regional CERTs including Canada’s Cyber Centre and HKCERT. The advisories span multiple high-severity issues, with affected versions including ColdFusion 2023.19 and 2025.8 and earlier, Dreamweaver 21.7 and earlier, Campaign Classic 7.4.3 build 9394 and earlier, and AEM Forms JEE LTS SP1 / 6.5.24.0 and earlier.

The most serious disclosures include multiple remote code execution bugs in Acrobat/Reader such as CVE-2026-47911, CVE-2026-47912, CVE-2026-47913, CVE-2026-47914, CVE-2026-47915, CVE-2026-47918, and CVE-2026-47919, largely tied to use-after-free conditions and malicious file handling; several ColdFusion flaws including CVE-2026-47928, CVE-2026-47929, CVE-2026-47930, CVE-2026-47931, and CVE-2026-47932 that can enable code execution, security feature bypass, or unauthorized read/write access; AEM Forms JEE stored and reflected XSS issues CVE-2026-34691 and CVE-2026-34693; Campaign Classic issues CVE-2026-47938 and CVE-2026-48303 involving SSRF, privilege escalation, and possible code execution; Dreamweaver arbitrary file read via CVE-2026-47907; and USD Fileformat Plugins heap-based buffer overflows CVE-2026-48291 and CVE-2026-48292. Adobe has issued patches for the affected products, and defenders are being urged to review the vendor bulletins and deploy updates quickly.