Loading story…
Adobe released security updates for InDesign, InCopy, Illustrator, Substance 3D Stager, and Adobe Commerce/Magento, alongside fixes noted for Substance 3D Designer and Photoshop Elements, addressing 45 vulnerabilities in total. According to CSIRT.SK, 23 of the flaws are rated critical, with impact ranging from remote code execution and privilege escalation to security feature bypass, unauthorized access to sensitive data, and denial of service.
The most serious issues affect both desktop creative applications and Adobe Commerce deployments. CSIRT.SK said several Commerce vulnerabilities can be exploited with no user interaction and include authorization failures, access-control weaknesses, path traversal, and stored XSS, while the desktop product flaws include critical memory-corruption bugs that could lead to code execution. Adobe published separate security bulletins for the affected products and urged customers to update to the fixed versions as soon as possible.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK published an advisory highlighting the critical Adobe vulnerabilities and urging users and administrators to update affected products to the fixed versions. The notice also warned against opening messages or attachments from untrusted sources.
Adobe released security updates for InDesign, Commerce/Magento, Substance 3D Stager, InCopy, Illustrator, Substance 3D Designer, and Photoshop Elements to address 45 vulnerabilities, including 23 rated critical. The flaws included issues that could lead to remote code execution, privilege escalation, security feature bypass, unauthorized access to sensitive data, and denial of service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcehelpx.adobe.com
Open sourcehelpx.adobe.com
Open sourcehelpx.adobe.com
Open sourcehelpx.adobe.com
Open sourcehelpx.adobe.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe released security updates for multiple products, including **Experience Manager**, **Adobe Commerce**/**Magento Open Source**, **InDesign**, **Substance 3D Sampler**, **InCopy**, **Acrobat Reader**, and **Substance 3D Painter**, addressing **252 vulnerabilities** in total. According to CSIRT.SK, **18 flaws are rated critical**, with impacts ranging from remote code execution and privilege escalation to security feature bypass, unauthorized access, cross-site scripting, and service disruption. The most severe issues highlighted include **`CVE-2025-47110`** affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, and **`CVE-2025-46840`** affecting Adobe Experience Manager. The vulnerabilities span memory corruption, improper authorization, insufficient input validation, and integer overflow, and many of the desktop-application issues can be triggered when a user opens a specially crafted file. Adobe published product-specific bulletins for Experience Manager, Magento, InDesign, and Substance 3D Sampler and urged customers to update to the remediated versions immediately.
Jul 24, 2026
Adobe released security updates for **After Effects, Audition, Bridge, Illustrator, Substance 3D Painter**, and additional products including **InDesign, Photoshop, and Adobe Commerce/Magento Open Source**, addressing **48 vulnerabilities** in total. According to CSIRT.SK, **28 of the flaws are rated critical**, and the most severe issues could let an unauthenticated attacker achieve **arbitrary code execution** if a user is tricked into opening a specially crafted file in affected creative applications. The advisories also cover weaknesses that could lead to **sensitive data exposure, security feature bypass, denial of service,** and **server-side request forgery (`SSRF`)**. Most of the code-execution bugs require user interaction, but the **Adobe Commerce/Magento** SSRF issue reportedly does **not** require user interaction, increasing risk for exposed deployments. Organizations using affected Adobe desktop software and commerce platforms were urged to apply the vendor patches promptly.
Jul 24, 2026
Adobe released security updates for multiple critical vulnerabilities affecting **Adobe FrameMaker Publishing Server**, **Adobe Commerce**, **Magento Open Source**, and the **Adobe Commerce Webhooks** extension. The most serious issues include `CVE-2024-30299` and `CVE-2024-30300` in FrameMaker Publishing Server and `CVE-2024-34102` in Adobe Commerce and Magento, with severity reaching **CVSS 10.0**. Successful exploitation could allow **arbitrary code execution**, **security feature bypass**, and **privilege escalation**. Adobe also issued critical fixes for **Adobe Experience Manager**, **Creative Cloud Desktop**, **Photoshop**, and **Substance 3D Stager** to address vulnerabilities that could enable code execution, unauthorized system access, and exposure of sensitive data. National cybersecurity authorities highlighted the breadth and severity of the flaws and urged organizations using affected Adobe products to apply vendor patches immediately in line with Adobe guidance.
Jun 29, 2026