ANSSI Flags Multiple Adobe Product Vulnerabilities
ANSSI advisory details numerous vulnerabilities in Acrobat, Acrobat Reader, ColdFusion, Adobe Commerce, and Magento allowing RCE, privilege escalation, and DoS.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
France's ANSSI (CERT-FR) issued a bulletin consolidating multiple Adobe security advisories (APSB26-119, APSB26-138, APSB26-141) covering Acrobat 2024, Acrobat Reader, Adobe Acrobat, Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and ColdFusion 2023/2025. The vulnerabilities span a wide range of impact categories including remote code execution, privilege escalation, remote denial of service, SQL injection, cross-site scripting (XSS), confidentiality breaches, and security policy bypass. Dozens of CVEs are referenced across the affected product lines, with no indication in this advisory of active exploitation in the wild.
Affected versions include Acrobat 2024 prior to 24.001.30429, Acrobat Reader and Adobe Acrobat prior to 26.002.21901 (Windows/macOS), ColdFusion 2023 prior to 2023.0.24, ColdFusion 2025 prior to 2025.0.13, and various Adobe Commerce/Magento Open Source branches (2.4.4 through 2.4.9, and B2B extensions 1.3.3 through 1.5.3) prior to their September 2026 patch releases. Organizations running any of these products should apply the vendor-supplied patches referenced in the underlying Adobe security bulletins as soon as possible, prioritizing ColdFusion and Commerce/Magento deployments given the presence of RCE and SQLi issues that could affect exposed e-commerce and application server environments.
This is a routine vendor patch consolidation advisory from a national CERT rather than a report of active exploitation or a novel attack campaign. Defenders should inventory affected Adobe products, confirm patch levels against the versions listed, and track for any subsequent in-the-wild exploitation reporting tied to these CVEs.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1140
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs