Adobe patches 50+ RCE flaws across product suite

Adobe fixed over 50 vulnerabilities in After Effects, Commerce/Magento, Connect, Premiere Pro, Illustrator and other products, several enabling arbitrary code execution.

Adobe has released patches addressing a large batch of vulnerabilities spanning After Effects, Commerce (including Magento Open Source and Commerce B2B), Connect, Media Encoder, Premiere Pro, Substance 3D Designer/Painter/Sampler, the Content Authenticity SDK, and Illustrator. The most severe issues include stack- and heap-based buffer overflows, out-of-bounds read/write, use-after-free, integer overflow/underflow, deserialization of untrusted data, and SSRF, which could allow arbitrary code execution in the context of the logged-on user if a victim opens a malicious file or an attacker exploits a vulnerable web-facing Commerce/Magento instance.

Adobe Commerce and Magento Open Source carry additional risk given their exposure as internet-facing e-commerce platforms, with flaws including incorrect/improper authorization, stored XSS, path traversal, and SSRF that could enable account takeover or server-side compromise beyond simple code execution on an end-user's machine. There are currently no reports of in-the-wild exploitation for any of these vulnerabilities, but given the breadth of affected creative and e-commerce products, organizations should prioritize patching per Adobe's stable channel updates, especially internet-facing Commerce/Magento deployments.

CISA/MS-ISAC recommends standard vulnerability management practices: prompt patch application after testing, least-privilege configurations, application allowlisting, anti-exploitation mitigations, and host-based intrusion detection/prevention to reduce risk from potential future exploitation.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-046