Adobe Patches Nearly 140 Vulnerabilities

According to Adobe, the company rolled out patches for nearly 140 vulnerabilities across its products this week, with the Experience Manager update alone addressing 117 issues, 116 of which are cross-site scripting flaws. ColdFusion received fixes for 12 security defects, several of which could allow arbitrary code execution, including CVE-2025-61808, CVE-2025-61809, and CVE-2025-61830 (CVSS 9.1).

The Experience Manager (AEM) update also fixes two critical-severity flaws, tracked as CVE-2025-64537 and CVE-2025-64539 (CVSS 9.3), while the remaining 114 XSS issues are medium severity. In addition, the release resolves a high-severity defect related to a vulnerable third-party component, and AEM Cloud Service release 2025.12 along with certain AEM versions address all security defects.

Adobe has given both the ColdFusion and AEM updates a priority rating of ‘1’, urging users to apply the fixes promptly; the company also disclosed fixes for two high- and two medium-severity holes in the DNG SDK, two high- and two low-severity issues in Acrobat and Reader, and one medium-severity flaw in Creative Cloud Desktop for macOS, stating it is not aware of any exploits in the wild. 9 December 2025.