Loading story…
Adobe released security updates for multiple products, including Experience Manager, Adobe Commerce/Magento Open Source, InDesign, Substance 3D Sampler, InCopy, Acrobat Reader, and Substance 3D Painter, addressing 252 vulnerabilities in total. According to CSIRT.SK, 18 flaws are rated critical, with impacts ranging from remote code execution and privilege escalation to security feature bypass, unauthorized access, cross-site scripting, and service disruption.
The most severe issues highlighted include CVE-2025-47110 affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, and CVE-2025-46840 affecting Adobe Experience Manager. The vulnerabilities span memory corruption, improper authorization, insufficient input validation, and integer overflow, and many of the desktop-application issues can be triggered when a user opens a specially crafted file. Adobe published product-specific bulletins for Experience Manager, Magento, InDesign, and Substance 3D Sampler and urged customers to update to the remediated versions immediately.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On June 10, 2025, Adobe published security bulletins and released updates for multiple products including Experience Manager, Commerce/Magento, InDesign, and Substance 3D Sampler. CSIRT.SK reported that the broader June release covered several Adobe products and fixed 252 vulnerabilities, including 18 rated critical.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcehelpx.adobe.com
Open sourcehelpx.adobe.com
Open sourcehelpx.adobe.com
Open sourcehelpx.adobe.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe released security updates for **InDesign**, **InCopy**, **Illustrator**, **Substance 3D Stager**, and **Adobe Commerce/Magento**, alongside fixes noted for **Substance 3D Designer** and **Photoshop Elements**, addressing **45 vulnerabilities** in total. According to CSIRT.SK, **23 of the flaws are rated critical**, with impact ranging from **remote code execution** and **privilege escalation** to **security feature bypass**, **unauthorized access to sensitive data**, and **denial of service**. The most serious issues affect both desktop creative applications and Adobe Commerce deployments. CSIRT.SK said several Commerce vulnerabilities can be exploited with **no user interaction** and include authorization failures, access-control weaknesses, path traversal, and stored **XSS**, while the desktop product flaws include critical memory-corruption bugs that could lead to code execution. Adobe published separate security bulletins for the affected products and urged customers to update to the fixed versions as soon as possible.
Jul 24, 2026
Adobe released security updates for **After Effects, Audition, Bridge, Illustrator, Substance 3D Painter**, and additional products including **InDesign, Photoshop, and Adobe Commerce/Magento Open Source**, addressing **48 vulnerabilities** in total. According to CSIRT.SK, **28 of the flaws are rated critical**, and the most severe issues could let an unauthenticated attacker achieve **arbitrary code execution** if a user is tricked into opening a specially crafted file in affected creative applications. The advisories also cover weaknesses that could lead to **sensitive data exposure, security feature bypass, denial of service,** and **server-side request forgery (`SSRF`)**. Most of the code-execution bugs require user interaction, but the **Adobe Commerce/Magento** SSRF issue reportedly does **not** require user interaction, increasing risk for exposed deployments. Organizations using affected Adobe desktop software and commerce platforms were urged to apply the vendor patches promptly.
Jul 24, 2026
Adobe released security updates for multiple critical vulnerabilities affecting **Adobe FrameMaker Publishing Server**, **Adobe Commerce**, **Magento Open Source**, and the **Adobe Commerce Webhooks** extension. The most serious issues include `CVE-2024-30299` and `CVE-2024-30300` in FrameMaker Publishing Server and `CVE-2024-34102` in Adobe Commerce and Magento, with severity reaching **CVSS 10.0**. Successful exploitation could allow **arbitrary code execution**, **security feature bypass**, and **privilege escalation**. Adobe also issued critical fixes for **Adobe Experience Manager**, **Creative Cloud Desktop**, **Photoshop**, and **Substance 3D Stager** to address vulnerabilities that could enable code execution, unauthorized system access, and exposure of sensitive data. National cybersecurity authorities highlighted the breadth and severity of the flaws and urged organizations using affected Adobe products to apply vendor patches immediately in line with Adobe guidance.
Jun 29, 2026