Loading story…
Adobe released security updates for ColdFusion, Acrobat Reader, Photoshop, and several Creative Cloud applications including Media Encoder, Audition, After Effects, Premiere Pro, and Illustrator to address 29 vulnerabilities, 19 of them rated critical. The most severe issue, CVE-2024-41874, affects ColdFusion and is an insecure deserialization flaw with a CVSS 9.8 score that can allow remote code execution without user interaction.
Adobe also patched multiple vulnerabilities in creative applications that could be triggered by opening specially crafted files, potentially leading to remote code execution, unauthorized access to sensitive data, unauthorized system changes, or denial of service. Security authorities urged organizations to apply the updates immediately, with particular priority on ColdFusion servers and widely deployed content creation tools that may be exposed to malicious files.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Adobe released security updates for Media Encoder, Audition, After Effects, Premiere Pro, Illustrator, Acrobat Reader, ColdFusion, and Photoshop to address 29 vulnerabilities, including 19 rated critical. The most severe issue disclosed was CVE-2024-41874 in Adobe ColdFusion, an insecure deserialization flaw that could allow remote code execution without user interaction.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcehelpx.adobe.com
Open sourcehelpx.adobe.com
Open sourcehelpx.adobe.com
Open sourcehelpx.adobe.com
Open sourcehelpx.adobe.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe released security updates for 12 products, fixing 88 vulnerabilities across its portfolio, with the most urgent issues affecting **ColdFusion**. The ColdFusion advisory was rated **Priority 1** and addresses 13 flaws, including eight critical vulnerabilities that could allow **arbitrary code execution** or **privilege escalation** through path traversal, code injection, improper input validation, missing authentication, SQL injection, and incorrect authorization. The fixes are included in **ColdFusion 2025 Update 11** and **ColdFusion 2023 Update 22**. Adobe also patched critical vulnerabilities in **Commerce**, **Experience Manager**, and **Illustrator**, and said it is not aware of any of the newly addressed vulnerabilities being exploited in the wild.
Jul 15, 2026
Adobe released security updates for multiple products, including **After Effects**, **Audition**, **InCopy**, **InDesign**, and **Substance 3D Viewer**, alongside fixes for **Adobe Connect**, **Dimension**, **Substance 3D Stager**, **Illustrator**, **FrameMaker**, **AEM Forms**, **AEM Screens**, and **ColdFusion**. The updates address **60 vulnerabilities**, including **38 rated critical**, with impacts ranging from remote code execution and privilege escalation to security feature bypass, unauthorized access, file disclosure, and denial of service. Several of the most severe issues affect enterprise-facing platforms. Reported high-risk flaws include `CVE-2025-27203` in **Adobe Connect** with a **CVSS 9.3**, `CVE-2025-49533` in **AEM Forms** with a **CVSS 9.8**, and multiple **ColdFusion** vulnerabilities such as `CVE-2025-49535` (**CVSS 9.3**) and `CVE-2025-49551` (**CVSS 8.8**), some of which require no user interaction. Adobe urged customers to apply the patched versions immediately and to avoid opening messages or attachments from unknown or untrusted sources.
Jul 24, 2026
Adobe has released Priority 1 security updates for **ColdFusion** and **Adobe Campaign Classic** to fix multiple high-severity vulnerabilities, including seven flaws rated `CVSS 10.0`. In ColdFusion, the patched issues affect versions `2025.9`, `2023.20`, and earlier, and include improper input validation (`CVE-2026-48281`, `CVE-2026-48277`), unrestricted file upload (`CVE-2026-48276`, `CVE-2026-48283`), and path traversal (`CVE-2026-48282`) bugs that could allow unauthenticated remote code execution without user interaction. Additional ColdFusion flaws include a path traversal issue with arbitrary file read and limited write access (`CVE-2026-48313`), an SSRF bug (`CVE-2026-48285`), and user-interaction issues such as reflected XSS (`CVE-2026-48307`) and improper input validation tied to malicious files (`CVE-2026-48315`). Adobe also patched `CVE-2026-48286` in **Adobe Campaign Classic**, an incorrect authorization flaw affecting version `7.4.3` and earlier that can lead to arbitrary code execution on on-premises instances. Adobe said it is not aware of in-the-wild exploitation of the specific vulnerabilities, but assigned the updates a **Priority 1** rating, indicating they are being targeted or are at high risk of being targeted, and urged administrators to patch within 72 hours. Recommended versions include **ColdFusion 2025 Update 10**, **ColdFusion 2023 Update 21**, and **Campaign Classic 7.4.4 / build 9397 or later**.
Jul 12, 2026