Adobe Patches Dozens of Flaws Across Five Products
Adobe issued patches for over 50 vulnerabilities in ColdFusion, Commerce, Lightroom, Content Credentials SDK, and Campaign Classic, some allowing arbitrary code execution.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-71362 as exploited in the wild.
CIS/MS-ISAC published an advisory detailing a large batch of vulnerabilities across five Adobe product lines: ColdFusion, Adobe Commerce (including Magento Open Source and Commerce B2B), Lightroom, the Content Credentials SDK (Rust/JS/C2PA tool), and Campaign Classic. The flaws span a wide range of vulnerability classes including OS command injection, eval injection, incorrect authorization, stored XSS, hard-coded cryptographic keys, heap-based buffer overflow, path traversal, deserialization of untrusted data, SSRF, SQL injection, and multiple memory-safety issues (out-of-bounds write, integer overflow/underflow, NULL pointer dereference).
The most severe issues could allow arbitrary code execution in the context of the logged-on user, potentially enabling an attacker to install programs, manipulate or exfiltrate data, or create new privileged accounts. Impact varies by the privilege level of the affected account, with users operating under least-privilege configurations facing reduced risk. No public reporting indicates any of these vulnerabilities are currently being exploited in the wild.
CIS recommends organizations apply Adobe's stable-channel updates after appropriate testing, and reinforces standard hardening measures: least-privilege enforcement, application/script allowlisting, anti-exploitation features, host-based intrusion detection/prevention, and routine vulnerability management and penetration testing programs. Given the breadth of affected products—spanning web application servers, e-commerce platforms, creative software, content-provenance SDKs, and marketing automation—organizations should inventory exposure across all five product lines.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-079
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs