Loading story…
Adobe released security updates for 36 vulnerabilities across products including Adobe Connect, Adobe Experience Manager (AEM) Forms, Bridge, Content Credentials Rust SDK, C2PA Tool, InDesign, Premiere Pro, and Substance 3D Modeler. The fixes cover nine critical- and 17 high-severity issues, with impacts including arbitrary code execution, privilege escalation, security-feature bypass, information disclosure, and denial of service.
Adobe Connect fixes include critical SQL injection, cross-site scripting, and input-validation flaws affecting Android, macOS, and Windows; CVE-2026-75682 carries a CVSS score of 9.9 and could allow malicious code deployment and execution, while CVE-2026-75684 can enable privilege escalation. AEM Forms also received patches for critical authorization, input-validation, and server-side request forgery issues, including code-execution flaw CVE-2026-75745. Adobe reports no known in-the-wild exploitation, but advises customers to apply the updates and hotfixes; Connect and AEM Forms advisories are rated priority 2, calling for remediation within 30 days.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Adobe released security patches for 36 vulnerabilities affecting products including Connect, Experience Manager Forms, Bridge, Content Credentials, InDesign, Substance 3D Modeler, and Premiere Pro. The updates addressed critical flaws in Connect and AEM Forms that could enable arbitrary code execution or privilege escalation; Adobe said it was unaware of active exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourceacn.gov.it
Open sourceheise.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe released security updates for multiple products, including **After Effects**, **Audition**, **InCopy**, **InDesign**, and **Substance 3D Viewer**, alongside fixes for **Adobe Connect**, **Dimension**, **Substance 3D Stager**, **Illustrator**, **FrameMaker**, **AEM Forms**, **AEM Screens**, and **ColdFusion**. The updates address **60 vulnerabilities**, including **38 rated critical**, with impacts ranging from remote code execution and privilege escalation to security feature bypass, unauthorized access, file disclosure, and denial of service. Several of the most severe issues affect enterprise-facing platforms. Reported high-risk flaws include `CVE-2025-27203` in **Adobe Connect** with a **CVSS 9.3**, `CVE-2025-49533` in **AEM Forms** with a **CVSS 9.8**, and multiple **ColdFusion** vulnerabilities such as `CVE-2025-49535` (**CVSS 9.3**) and `CVE-2025-49551` (**CVSS 8.8**), some of which require no user interaction. Adobe urged customers to apply the patched versions immediately and to avoid opening messages or attachments from unknown or untrusted sources.
Jul 24, 2026
Adobe disclosed two high-severity vulnerabilities in **Adobe Connect** affecting versions **2025.3, 12.10, and earlier**, and directed customers to advisory **`APSB26-37`** for remediation. One issue, **`CVE-2026-27246`**, is a DOM-based cross-site scripting flaw classified as **`CWE-79`** that can let an attacker manipulate the browser DOM and run malicious JavaScript in a victim’s session after luring the user to a crafted webpage. The vulnerability carries a CVSS v3.1 vector of **`AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N`**, indicating network reachability, low attack complexity, no privileges required, and high confidentiality and integrity impact. Adobe also disclosed **`CVE-2026-34615`**, a **`CWE-502`** deserialization of untrusted data vulnerability in the same product versions that can lead to arbitrary code execution in the context of the current user. Adobe said exploitation of the deserialization flaw does not require user interaction, making it the more serious of the two issues, while both bugs were published through Adobe’s PSIRT process and affect the same supported and earlier Adobe Connect releases. Organizations using Adobe Connect should prioritize patching exposed deployments and reviewing the vendor advisory for fixed versions and mitigation guidance.
Jun 29, 2026
Adobe released a broad set of security updates covering **Adobe Experience Manager**, **Acrobat/Reader**, **ColdFusion**, **Dreamweaver**, **InDesign**, **InCopy**, **Substance 3D Sampler**, **Format Plugins**, **Campaign Classic**, and Content Credentials SDK components, prompting alerts from national and regional CERTs including Canada’s Cyber Centre and HKCERT. The advisories span multiple high-severity issues, with affected versions including **ColdFusion 2023.19 and 2025.8 and earlier**, **Dreamweaver 21.7 and earlier**, **Campaign Classic 7.4.3 build 9394 and earlier**, and **AEM Forms JEE LTS SP1 / 6.5.24.0 and earlier**. The most serious disclosures include multiple **remote code execution** bugs in Acrobat/Reader such as `CVE-2026-47911`, `CVE-2026-47912`, `CVE-2026-47913`, `CVE-2026-47914`, `CVE-2026-47915`, `CVE-2026-47918`, and `CVE-2026-47919`, largely tied to use-after-free conditions and malicious file handling; several **ColdFusion** flaws including `CVE-2026-47928`, `CVE-2026-47929`, `CVE-2026-47930`, `CVE-2026-47931`, and `CVE-2026-47932` that can enable code execution, security feature bypass, or unauthorized read/write access; **AEM Forms JEE** stored and reflected XSS issues `CVE-2026-34691` and `CVE-2026-34693`; **Campaign Classic** issues `CVE-2026-47938` and `CVE-2026-48303` involving SSRF, privilege escalation, and possible code execution; **Dreamweaver** arbitrary file read via `CVE-2026-47907`; and **USD Fileformat Plugins** heap-based buffer overflows `CVE-2026-48291` and `CVE-2026-48292`. Adobe has issued patches for the affected products, and defenders are being urged to review the vendor bulletins and deploy updates quickly.
Jun 29, 2026