Adobe Patches Critical ColdFusion and Commerce Vulnerabilities

Adobe has patched nearly two dozen vulnerabilities across nine of its products in the September 2025 Patch Tuesday updates, including critical flaws in ColdFusion and Commerce.

The critical ColdFusion vulnerability is tracked as CVE-2025-54261, with a CVSS score of 9.0, described as a path traversal issue that can lead to arbitrary file system write and affects ColdFusion 2021, 2023, and 2025 on all platforms; Adobe says it is not aware of any in-the-wild exploitation, but has given it a priority rating of 1, meaning it should be addressed as soon as possible (within 72 hours is recommended).

The article notes that it is not uncommon for threat actors to exploit ColdFusion vulnerabilities, pointing to CVE-2024-20767 which was exploited in December 2024. The Commerce fix, also in Magento Open Source, is CVE-2025-54236, which can be exploited by an unauthenticated attacker to bypass a security feature.

Other patched high- to medium-severity issues span Acrobat Reader, Premiere Pro, Substance 3D Viewer, Experience Manager (AEM), Dreamweaver, and Substance 3D Modeler, and can allow arbitrary code execution and security feature bypasses. The piece also mentions that high- and medium-severity flaws are rated with a priority of 3, indicating Adobe does not expect them to be exploited in attacks.