Adobe Patches Roughly 140 Flaws, Including Critical ColdFusion and AEM Code Execution

Adobe issued 10 security advisories addressing roughly 140 vulnerabilities across its products, including critical code-execution and privilege-escalation flaws in ColdFusion and Commerce and numerous code-execution flaws in creative applications. ColdFusion bulletin APSB26-144 fixes 32 vulnerabilities: 10 critical, 21 high and one medium, with two critical flaws scoring CVSS 10.0. Separately, CVE-2026-106612 is a CVSS 9.9 ColdFusion authorization flaw allowing a low-privileged remote attacker to execute arbitrary code without user interaction. Adobe Experience Manager vulnerability CVE-2026-90532 also permits arbitrary code execution; its recorded attack vector requires neither privileges nor user interaction. Content Credentials SDK received 30 fixes, primarily for high-severity security-feature bypass issues, with some flaws capable of causing denial of service. Adobe reported no known exploitation in the wild.

Prioritize exposed ColdFusion deployments: Adobe identifies versions 2025.0.13 and 2023.0.25 as affected on all platforms and recommends upgrading to 2025.0.14 and 2023.0.26, respectively. The ColdFusion bulletin contains inconsistent urgency labels—priority 2 overall but priority 1 in its solution table—so organizations should not assume it shares the lower urgency reported for most updates. Commerce received priority 2 because attackers have historically targeted the product. Experience Manager administrators should consult APSB26-152 to establish affected versions and required updates, which were not specified in the supplied vulnerability record. Adobe attributed the increased patch volume partly to AI-assisted vulnerability discovery and has moved bulletin publication to twice monthly, while retaining human review of AI-assisted code changes.