Loading story…
Adobe released security updates for Photoshop, Substance 3D Stager, Illustrator on iPad, Animate, and Substance 3D Designer to fix 14 critical vulnerabilities that could allow arbitrary code execution. The issues affect older versions of the products and stem from flaws that can be triggered when a user opens a specially crafted malicious file, giving a remote unauthenticated attacker a path to compromise a targeted system.
Adobe advised customers to upgrade immediately to patched versions including Photoshop 26.2/25.12.1, Substance 3D Stager 3.1.0, Illustrator on iPad 3.0.8, Animate 23.0.10/24.0.7, and Substance 3D Designer 14.1. CSIRT.SK highlighted that exploitation requires user interaction to download and open the malicious content, but the bugs were rated critical because successful exploitation could result in code execution on affected devices.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Adobe released security updates for Adobe Photoshop, Adobe Substance 3D Stager, Adobe Illustrator on iPad, Adobe Animate, and Adobe Substance 3D Designer. The updates addressed 14 critical vulnerabilities that could allow arbitrary code execution via specially crafted files and required user interaction to exploit.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcehelpx.adobe.com
Open sourcehelpx.adobe.com
Open sourcehelpx.adobe.com
Open sourcehelpx.adobe.com
Open sourcehelpx.adobe.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe released security updates for a broad set of products including **Acrobat and Reader**, **Experience Manager**, **Media Encoder**, **Illustrator**, **After Effects**, **Animate**, **InDesign**, **PDFL SDK**, **Connect**, **Photoshop**, **Premiere Pro**, **Bridge**, **FrameMaker**, and multiple **Substance 3D** applications. The advisories cover **165 vulnerabilities**, including **45 rated critical**, with impacts spanning **remote code execution**, **privilege escalation**, **unauthorized access to sensitive data**, **security feature bypass**, and **denial of service**. Many of the most severe issues can be triggered by opening specially crafted files, creating a significant risk for desktop creative tools such as Acrobat, Illustrator, After Effects, and Media Encoder, while some **Adobe Connect** flaws can be exploited remotely without authentication and include reflected **XSS** and privilege-escalation issues. Adobe published product-specific bulletins for affected offerings such as `APSB24-92` for Acrobat, `APSB24-69` for Experience Manager, `APSB24-93` for Media Encoder, `APSB24-94` for Illustrator, and `APSB24-95` for After Effects, and urged customers to upgrade to the patched versions immediately.
Jul 24, 2026
Adobe released security updates for **After Effects, Audition, Bridge, Illustrator, Substance 3D Painter**, and additional products including **InDesign, Photoshop, and Adobe Commerce/Magento Open Source**, addressing **48 vulnerabilities** in total. According to CSIRT.SK, **28 of the flaws are rated critical**, and the most severe issues could let an unauthenticated attacker achieve **arbitrary code execution** if a user is tricked into opening a specially crafted file in affected creative applications. The advisories also cover weaknesses that could lead to **sensitive data exposure, security feature bypass, denial of service,** and **server-side request forgery (`SSRF`)**. Most of the code-execution bugs require user interaction, but the **Adobe Commerce/Magento** SSRF issue reportedly does **not** require user interaction, increasing risk for exposed deployments. Organizations using affected Adobe desktop software and commerce platforms were urged to apply the vendor patches promptly.
Jul 24, 2026
Adobe released security updates for **InDesign**, **InCopy**, **Illustrator**, **Substance 3D Stager**, and **Adobe Commerce/Magento**, alongside fixes noted for **Substance 3D Designer** and **Photoshop Elements**, addressing **45 vulnerabilities** in total. According to CSIRT.SK, **23 of the flaws are rated critical**, with impact ranging from **remote code execution** and **privilege escalation** to **security feature bypass**, **unauthorized access to sensitive data**, and **denial of service**. The most serious issues affect both desktop creative applications and Adobe Commerce deployments. CSIRT.SK said several Commerce vulnerabilities can be exploited with **no user interaction** and include authorization failures, access-control weaknesses, path traversal, and stored **XSS**, while the desktop product flaws include critical memory-corruption bugs that could lead to code execution. Adobe published separate security bulletins for the affected products and urged customers to update to the fixed versions as soon as possible.
Jul 24, 2026