Adobe patches about 140 vulnerabilities across 10 products, including ColdFusion and Commerce

Adobe on October 13 released 10 security advisories addressing roughly 140 vulnerabilities across 10 products, including critical code execution flaws in ColdFusion and Adobe Commerce, SecurityWeek reported. The company said it is not aware of any of the vulnerabilities being exploited in the wild, but the affected server products have historically been popular targets for attackers.

What happened

According to SecurityWeek, the largest batch of fixes went to Adobe ColdFusion, which received patches for 32 vulnerabilities, including critical flaws that enable code execution and privilege escalation, documented in advisory APSB26-144. The Content Credentials SDK received fixes for 30 vulnerabilities, many rated high severity, that can lead to a security feature bypass, with some exploitable for denial of service.

Adobe Photoshop received fixes for 18 vulnerabilities, nearly all of which allow arbitrary code execution, while Substance 3D Stager received 16 fixes, many of them high-severity code execution bugs. Adobe Commerce was patched against 11 vulnerabilities, including several critical flaws that can be exploited without authentication to execute code or escalate privileges. FrameMaker, Dimension, Substance 3D Sampler, Substance 3D Designer and Bridge each received fixes for several code execution flaws.

Technical details

SecurityWeek reports that most of the advisories carry a priority rating of 3, meaning Adobe does not expect attacks. Adobe Commerce is the only product rated priority 2, reflecting the platform's history of being targeted by threat actors. Many of the findings were credited to external researchers. Adobe also said it uses frontier AI models to find flaws, which partly explains the higher volume, and that engineers review and approve all AI-assisted code changes.

The company has also moved from monthly to twice-monthly security bulletins, released on the second and fourth Tuesday of each month, according to SecurityWeek.

Who is affected

Organizations running ColdFusion servers and Adobe Commerce or Magento-based online stores face the most significant exposure, since those products are reachable over the internet and include critical flaws, some exploitable without authentication. Designers and creative teams using Photoshop, Substance 3D tools, FrameMaker, Dimension and Bridge are exposed mainly through malicious files that could trigger code execution when opened.

What to do

Administrators should review Adobe's security bulletins page for the exact fixed versions and CVE identifiers, and prioritize updating internet-facing ColdFusion and Adobe Commerce installations. Desktop users should install updates through the Creative Cloud application and avoid opening untrusted project or image files until patched. With Adobe now publishing bulletins twice a month, patch management teams should adjust their schedules to check for releases on both the second and fourth Tuesday.