Adobe Patches Critical Flaws Across ColdFusion, Experience Manager, Animate, and Commerce

Adobe released a broad set of security advisories covering creative, enterprise, and e-commerce products, and the Canadian Centre for Cyber Security urged organizations to review and apply the updates. Affected software includes ColdFusion, Adobe Experience Manager (AEM), Adobe Commerce, Magento Open Source, Animate, After Effects, Audition, Bridge, Media Encoder, Premiere, Premiere Pro, Illustrator, Creative Cloud Desktop Application, and Content Credentials tools and SDKs.

Among the disclosed issues, ColdFusion flaws CVE-2026-48363 and CVE-2026-48364 are uncontrolled search path vulnerabilities that can lead to arbitrary code execution when a user opens a malicious file; Animate bugs CVE-2026-48345 and CVE-2026-48350 can also enable code execution via malicious files through OS command injection and path traversal; and AEM vulnerabilities CVE-2026-48310 and CVE-2026-48252 are more severe for internet-facing deployments because they require no user interaction and can allow arbitrary file reads, unauthorized write access, and security feature bypass. Adobe also issued fixes for multiple Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and Adobe Commerce Webhooks Plugin vulnerabilities, including stored XSS, incorrect authorization, improper output encoding, and unrestricted file upload issues, with patched July 2026 releases and Webhooks Plugin version 1.21.0 identified as remediated versions.