ADOBE has published ten security advisories detailing around 140 vulnerabilities across ten products, including ColdFusion, Commerce, Photoshop, Substance 3D, Dimension, FrameMaker and Bridge. The disclosures show a broad patch effort with specific focus in ColdFusion (32 flaws), the Content Credentials SDK (30 flaws), Photoshop (18 flaws), Substance 3D Stager (16 flaws) and Commerce (11 flaws).
Most of the fixes relate to high‑risk issues such as arbitrary code execution and privilege escalation, with several vulnerabilities that could be exploited without authentication.
Adobe notes that there is no known in‑the‑wild exploitation at this time, and the majority of advisories carry a priority rating of 3, indicating a lower immediate exploitation risk. Commerce is the standout exception with a priority rating of 2, reflecting historical targeting of that product by attackers. The company also highlighted that AI-assisted toolchains are aiding flaw discovery, yet all AI‑generated code changes are reviewed and validated by engineers before deployment.
Adobe has shifted from monthly to a twice‑monthly bulletin schedule, publishing on the second and fourth Tuesday of each month as part of its assurance and disclosure cadence. Consumers and organisations using these products should apply the patches promptly to mitigate potential future exploitation.