Cert-In-Advisories

[CIVN-2026-0458] Multiple Vulnerabilities in Adobe Products

By TeamwinPublished On: September 17, 2026

—–BEGIN PGP SIGNED MESSAGE—–

Hash: SHA256

Multiple Vulnerabilities in Adobe Products

Indian – Computer Emergency Response Team (https://www.cert-in.org.in)

Severity Rating: CRITICAL

Software Affected

Adobe Experience Manager (AEM) Cloud Service (CS) Release 2026.7.0 and earlier versions.

Adobe Experience Manager (AEM) 6.5 LTS Service Pack 2 and earlier versions.

Adobe Experience Manager (AEM) 6.5 Service Pack 24 and earlier versions.

Adobe ColdFusion 2025 version 2025.0.12 and earlier versions.

Adobe ColdFusion 2023 version 2023.0.23 and earlier versions.

Adobe Photoshop 2026 version 27.6 and earlier versions for Windows and macOS.

Adobe Photoshop 2025 version 26.11.6 and earlier versions for Windows and macOS.

Adobe Illustrator 2025 version 29.8.10 and earlier versions for Windows.

Adobe Illustrator 2026 version 30.7 and earlier versions for Windows.

Adobe Animate 2023 version 23.0.16 and earlier versions for Windows and macOS.

Adobe Animate 2024 version 24.0.14 and earlier versions for Windows and macOS.

Adobe Photoshop Mobile version 1.6.0.2299 and earlier versions for Android.

Adobe Commerce 2.4.9-2026-aug and earlier versions, 2.4.8-2026-aug and earlier versions, 2.4.7-2026-aug and earlier versions, 2.4.6-2026-aug and earlier versions, 2.4.5-2026-aug and earlier versions, and 2.4.4-2026-aug and earlier versions.

Adobe Commerce B2B 1.5.3-2026-aug and earlier versions, 1.5.2-2026-aug and earlier versions, 1.4.2-2026-aug and earlier versions, 1.3.4-2026-aug and earlier versions, and 1.3.3-2026-aug and earlier versions.

Magento Open Source 2.4.9-2026-aug and earlier versions, 2.4.8-2026-aug and earlier versions, 2.4.7-2026-aug and earlier versions, and 2.4.6-2026-aug and earlier versions.

Adobe Acrobat Continuous 26.002.21900 and earlier versions for Windows and macOS.

Acrobat Reader Continuous 26.002.21900 and earlier versions for Windows and macOS.

Acrobat 2024 Classic 2024 version 24.001.30383 and earlier versions for Windows and macOS.

Adobe Campaign Classic ACC v7 version 7.4.4 build 9401 and earlier versions for Windows and Linux.

Overview

Multiple vulnerabilities have been reported in various Adobe products which could allow attackers to execute arbitrary code, escalate privileges, bypass security restrictions, disclose sensitive information, access or modify files, or cause denial-of-service (DoS) conditions on affected systems.

Target Audience:

All end-user organizations and individuals using affected Adobe products.

Risk Assessment:

Critical risk of arbitrary code execution, privilege escalation, security feature bypass, sensitive information disclosure and compromise of affected systems.

Impact Assessment:

Potential for arbitrary code execution, privilege escalation, unauthorized access to or modification of sensitive information and files, security feature bypass and denial-of-service (DoS) conditions.

Description

Adobe Experience Manager, ColdFusion, Photoshop, Illustrator, Animate, Photoshop Mobile, Adobe Commerce, Magento Open Source, Acrobat, Acrobat Reader and Campaign Classic are software products used for content management, application development, digital content creation, image editing, document processing, e-commerce and marketing operations.

Multiple vulnerabilities have been identified in the affected Adobe products, including improper authorization, cross-site scripting (XSS), improper input validation, code injection, SQL injection, path traversal, out-of-bounds memory access, use-after-free, prototype pollution, integer overflow, heap-based buffer overflow, improper access control, uncontrolled resource consumption and OS command injection vulnerabilities. These vulnerabilities could be exploited through specially crafted requests, files, inputs or application interactions, depending on the affected product and vulnerability.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, escalate privileges, bypass security restrictions, access or modify files, disclose sensitive information or cause denial-of-service (DoS) conditions. Notably, CVE-2026-75650 affecting Adobe Commerce, Adobe Commerce B2B and Magento Open Source is a critical remote code execution vulnerability that can be exploited by an unauthenticated remote attacker to execute arbitrary code on a vulnerable server.

NOTE: Adobe has confirmed that CVE-2026-75650 is being exploited in the wild.

Solution

Apply appropriate updates as mentioned as mentioned by the Vendor:

https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html

https://helpx.adobe.com/security/products/coldfusion/apsb26-119.html

https://helpx.adobe.com/security/products/photoshop/apsb26-130.html

https://helpx.adobe.com/security/products/illustrator/apsb26-131.html

https://helpx.adobe.com/security/products/animate/apsb26-132.html

https://helpx.adobe.com/security/products/photoshop-mobile/apsb26-136.html

https://helpx.adobe.com/security/products/magento/apsb26-138.html

https://helpx.adobe.com/security/products/acrobat/apsb26-141.html

https://helpx.adobe.com/security/products/campaign/apsb26-142.html

https://helpx.adobe.com/security/products/magento/apsb26-146.html

Vendor Information

Adobe

https://helpx.adobe.com/security.html

References