Loading story…
Adobe released a broad set of security advisories covering creative, enterprise, and e-commerce products, and the Canadian Centre for Cyber Security urged organizations to review and apply the updates. Affected software includes ColdFusion, Adobe Experience Manager (AEM), Adobe Commerce, Magento Open Source, Animate, After Effects, Audition, Bridge, Media Encoder, Premiere, Premiere Pro, Illustrator, Creative Cloud Desktop Application, and Content Credentials tools and SDKs.
Among the disclosed issues, ColdFusion flaws CVE-2026-48363 and CVE-2026-48364 are uncontrolled search path vulnerabilities that can lead to arbitrary code execution when a user opens a malicious file; Animate bugs CVE-2026-48345 and CVE-2026-48350 can also enable code execution via malicious files through OS command injection and path traversal; and AEM vulnerabilities CVE-2026-48310 and CVE-2026-48252 are more severe for internet-facing deployments because they require no user interaction and can allow arbitrary file reads, unauthorized write access, and security feature bypass. Adobe also issued fixes for multiple Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and Adobe Commerce Webhooks Plugin vulnerabilities, including stored XSS, incorrect authorization, improper output encoding, and unrestricted file upload issues, with patched July 2026 releases and Webhooks Plugin version 1.21.0 identified as remediated versions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published alert AV26-697 highlighting Adobe's July 14, 2026 security advisories across numerous Adobe products. The notice urged users and administrators to review Adobe's advisories and apply the necessary updates.
CISA updated its Known Exploited Vulnerabilities catalog and added CVE-2026-56155, CVE-2026-56164, CVE-2026-15409, and CVE-2026-15410. The newly listed flaws affected Microsoft ADFS, Microsoft SharePoint Server, and SonicWall SMA1000 appliances.
Adobe disclosed several vulnerabilities affecting Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin, including CVE-2026-48358, CVE-2026-47984, CVE-2026-47995, CVE-2026-48356, and CVE-2026-47994. The notices identified vulnerable version ranges and July 2026 fixed releases, including Webhooks Plugin version 1.21.0.
Adobe disclosed CVE-2026-48310 and CVE-2026-48252 affecting Adobe Experience Manager as a Cloud Service, 6.5 LTS, and 6.5. The issues include path traversal and missing authentication, with Adobe listing fixed versions and hotfix guidance.
Adobe disclosed CVE-2026-48345 and CVE-2026-48350 affecting Adobe Animate 2023 and 2024. The flaws can lead to arbitrary code execution when a victim opens a malicious file, and Adobe identified fixes in versions 23.0.16 and 24.0.14.
Adobe published security advisories covering multiple product lines including ColdFusion, Animate, Experience Manager, Commerce, Magento Open Source, Creative Cloud Desktop Application, Illustrator, and other creative tools. The advisories addressed critical vulnerabilities and provided updated or fixed versions across the affected products.
Adobe disclosed CVE-2026-48363 and CVE-2026-48364 affecting ColdFusion 2025.9 and earlier and 2023.20 and earlier. Both uncontrolled search path element flaws can lead to arbitrary code execution if a user opens a malicious file, and Adobe referenced advisory APSB26-68.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
16 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe released a broad set of security updates covering **Adobe Experience Manager**, **Acrobat/Reader**, **ColdFusion**, **Dreamweaver**, **InDesign**, **InCopy**, **Substance 3D Sampler**, **Format Plugins**, **Campaign Classic**, and Content Credentials SDK components, prompting alerts from national and regional CERTs including Canada’s Cyber Centre and HKCERT. The advisories span multiple high-severity issues, with affected versions including **ColdFusion 2023.19 and 2025.8 and earlier**, **Dreamweaver 21.7 and earlier**, **Campaign Classic 7.4.3 build 9394 and earlier**, and **AEM Forms JEE LTS SP1 / 6.5.24.0 and earlier**. The most serious disclosures include multiple **remote code execution** bugs in Acrobat/Reader such as `CVE-2026-47911`, `CVE-2026-47912`, `CVE-2026-47913`, `CVE-2026-47914`, `CVE-2026-47915`, `CVE-2026-47918`, and `CVE-2026-47919`, largely tied to use-after-free conditions and malicious file handling; several **ColdFusion** flaws including `CVE-2026-47928`, `CVE-2026-47929`, `CVE-2026-47930`, `CVE-2026-47931`, and `CVE-2026-47932` that can enable code execution, security feature bypass, or unauthorized read/write access; **AEM Forms JEE** stored and reflected XSS issues `CVE-2026-34691` and `CVE-2026-34693`; **Campaign Classic** issues `CVE-2026-47938` and `CVE-2026-48303` involving SSRF, privilege escalation, and possible code execution; **Dreamweaver** arbitrary file read via `CVE-2026-47907`; and **USD Fileformat Plugins** heap-based buffer overflows `CVE-2026-48291` and `CVE-2026-48292`. Adobe has issued patches for the affected products, and defenders are being urged to review the vendor bulletins and deploy updates quickly.
Jun 29, 2026
Adobe released security updates for multiple critical vulnerabilities affecting **Adobe FrameMaker Publishing Server**, **Adobe Commerce**, **Magento Open Source**, and the **Adobe Commerce Webhooks** extension. The most serious issues include `CVE-2024-30299` and `CVE-2024-30300` in FrameMaker Publishing Server and `CVE-2024-34102` in Adobe Commerce and Magento, with severity reaching **CVSS 10.0**. Successful exploitation could allow **arbitrary code execution**, **security feature bypass**, and **privilege escalation**. Adobe also issued critical fixes for **Adobe Experience Manager**, **Creative Cloud Desktop**, **Photoshop**, and **Substance 3D Stager** to address vulnerabilities that could enable code execution, unauthorized system access, and exposure of sensitive data. National cybersecurity authorities highlighted the breadth and severity of the flaws and urged organizations using affected Adobe products to apply vendor patches immediately in line with Adobe guidance.
Jun 29, 2026
Adobe released security updates for 12 products, fixing 88 vulnerabilities across its portfolio, with the most urgent issues affecting **ColdFusion**. The ColdFusion advisory was rated **Priority 1** and addresses 13 flaws, including eight critical vulnerabilities that could allow **arbitrary code execution** or **privilege escalation** through path traversal, code injection, improper input validation, missing authentication, SQL injection, and incorrect authorization. The fixes are included in **ColdFusion 2025 Update 11** and **ColdFusion 2023 Update 22**. Adobe also patched critical vulnerabilities in **Commerce**, **Experience Manager**, and **Illustrator**, and said it is not aware of any of the newly addressed vulnerabilities being exploited in the wild.
Jul 15, 2026