Adobe fixes 252 flaws across Experience Manager, Commerce, InDesign and other products

Adobe released security updates for multiple products, including Experience Manager, Adobe Commerce/Magento Open Source, InDesign, Substance 3D Sampler, InCopy, Acrobat Reader, and Substance 3D Painter, addressing 252 vulnerabilities in total. According to CSIRT.SK, 18 flaws are rated critical, with impacts ranging from remote code execution and privilege escalation to security feature bypass, unauthorized access, cross-site scripting, and service disruption.

The most severe issues highlighted include CVE-2025-47110 affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, and CVE-2025-46840 affecting Adobe Experience Manager. The vulnerabilities span memory corruption, improper authorization, insufficient input validation, and integer overflow, and many of the desktop-application issues can be triggered when a user opens a specially crafted file. Adobe published product-specific bulletins for Experience Manager, Magento, InDesign, and Substance 3D Sampler and urged customers to update to the remediated versions immediately.