Loading story…
Adobe released security updates for nine high-severity vulnerabilities affecting Adobe Bridge and Adobe Format Plugins, including CVE-2026-48390, an incorrect authorization flaw in Bridge that can enable privilege escalation and unauthorized read and write access when a user opens a malicious file. The issues also include vulnerabilities that could lead to arbitrary code execution, affecting software used to manage, organize, and process digital content and file formats.
Affected versions include Adobe Bridge 15.x before 15.1.7 LTS, 16.x before 16.0.6, and Format Plugins before 2026.05. Adobe lists Bridge 15.1.7 and 16.0.6 as fixed versions for the authorization bug, which carries a CVSS v3.1 vector of AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, indicating high confidentiality and integrity impact with required user interaction. Users are being urged to apply the vendor updates to reduce the risk of code execution and privilege escalation from malicious files.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Adobe released security updates addressing nine high-severity vulnerabilities in Adobe Bridge and Format Plugins, including CVE-2026-48390. The updates affect Adobe Bridge 15.x before 15.1.7 LTS, Adobe Bridge 16.x before 16.0.6, and Format Plugins before version 2026.05.
CVE-2026-48390 was newly recorded as an Incorrect Authorization flaw in Adobe Bridge that can enable privilege escalation and unauthorized read and write access when a victim opens a malicious file. The record identifies Adobe Bridge versions up to 16.0.5 and 15.1.6 as affected, with versions 16.0.6 and 15.1.7 listed as unaffected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe released security updates for a broad set of products including **Acrobat and Reader**, **Experience Manager**, **Media Encoder**, **Illustrator**, **After Effects**, **Animate**, **InDesign**, **PDFL SDK**, **Connect**, **Photoshop**, **Premiere Pro**, **Bridge**, **FrameMaker**, and multiple **Substance 3D** applications. The advisories cover **165 vulnerabilities**, including **45 rated critical**, with impacts spanning **remote code execution**, **privilege escalation**, **unauthorized access to sensitive data**, **security feature bypass**, and **denial of service**. Many of the most severe issues can be triggered by opening specially crafted files, creating a significant risk for desktop creative tools such as Acrobat, Illustrator, After Effects, and Media Encoder, while some **Adobe Connect** flaws can be exploited remotely without authentication and include reflected **XSS** and privilege-escalation issues. Adobe published product-specific bulletins for affected offerings such as `APSB24-92` for Acrobat, `APSB24-69` for Experience Manager, `APSB24-93` for Media Encoder, `APSB24-94` for Illustrator, and `APSB24-95` for After Effects, and urged customers to upgrade to the patched versions immediately.
Jul 24, 2026
Adobe released security updates for multiple products, including **After Effects**, **Audition**, **InCopy**, **InDesign**, and **Substance 3D Viewer**, alongside fixes for **Adobe Connect**, **Dimension**, **Substance 3D Stager**, **Illustrator**, **FrameMaker**, **AEM Forms**, **AEM Screens**, and **ColdFusion**. The updates address **60 vulnerabilities**, including **38 rated critical**, with impacts ranging from remote code execution and privilege escalation to security feature bypass, unauthorized access, file disclosure, and denial of service. Several of the most severe issues affect enterprise-facing platforms. Reported high-risk flaws include `CVE-2025-27203` in **Adobe Connect** with a **CVSS 9.3**, `CVE-2025-49533` in **AEM Forms** with a **CVSS 9.8**, and multiple **ColdFusion** vulnerabilities such as `CVE-2025-49535` (**CVSS 9.3**) and `CVE-2025-49551` (**CVSS 8.8**), some of which require no user interaction. Adobe urged customers to apply the patched versions immediately and to avoid opening messages or attachments from unknown or untrusted sources.
Jul 24, 2026
Adobe released a broad set of security updates covering **Adobe Experience Manager**, **Acrobat/Reader**, **ColdFusion**, **Dreamweaver**, **InDesign**, **InCopy**, **Substance 3D Sampler**, **Format Plugins**, **Campaign Classic**, and Content Credentials SDK components, prompting alerts from national and regional CERTs including Canada’s Cyber Centre and HKCERT. The advisories span multiple high-severity issues, with affected versions including **ColdFusion 2023.19 and 2025.8 and earlier**, **Dreamweaver 21.7 and earlier**, **Campaign Classic 7.4.3 build 9394 and earlier**, and **AEM Forms JEE LTS SP1 / 6.5.24.0 and earlier**. The most serious disclosures include multiple **remote code execution** bugs in Acrobat/Reader such as `CVE-2026-47911`, `CVE-2026-47912`, `CVE-2026-47913`, `CVE-2026-47914`, `CVE-2026-47915`, `CVE-2026-47918`, and `CVE-2026-47919`, largely tied to use-after-free conditions and malicious file handling; several **ColdFusion** flaws including `CVE-2026-47928`, `CVE-2026-47929`, `CVE-2026-47930`, `CVE-2026-47931`, and `CVE-2026-47932` that can enable code execution, security feature bypass, or unauthorized read/write access; **AEM Forms JEE** stored and reflected XSS issues `CVE-2026-34691` and `CVE-2026-34693`; **Campaign Classic** issues `CVE-2026-47938` and `CVE-2026-48303` involving SSRF, privilege escalation, and possible code execution; **Dreamweaver** arbitrary file read via `CVE-2026-47907`; and **USD Fileformat Plugins** heap-based buffer overflows `CVE-2026-48291` and `CVE-2026-48292`. Adobe has issued patches for the affected products, and defenders are being urged to review the vendor bulletins and deploy updates quickly.
Jun 29, 2026