Adobe has published 11 new security advisories to inform customers about roughly 176 vulnerabilities found and patched in its products.
Adobe Experience Manager (AEM) received patches for 36 vulnerabilities, including several critical flaws allowing arbitrary code execution. The list also includes privilege escalation and security bypass issues.
Adobe ColdFusion updates address 32 vulnerabilities, including critical bugs that can be exploited for code execution and privilege escalation.
A significant number of flaws have been patched by Adobe in the Content Credentials SDK. The product received fixes for 30 vulnerabilities, many described as high-severity issues that can lead to a security feature bypass. Some security holes can be exploited to cause a DoS condition.
Adobe patched 18 vulnerabilities in Photoshop, nearly all allowing arbitrary code execution.
In Substance 3D Stager, Adobe fixed 16 vulnerabilities, including many high-severity arbitrary code execution flaws.
Eleven vulnerabilities have been resolved in Adobe Commerce, including several critical issues that can be exploited without authentication to execute code or escalate privileges.
Several vulnerabilities that allow arbitrary code execution have been fixed in each of the following products: FrameMaker, Dimension, Substance 3D Sampler, Substance 3D Designer, and Bridge.
Adobe says it’s not aware of any in-the-wild exploitation. Most advisories have a priority rating of 3, which indicates Adobe does not expect to see these vulnerabilities exploited in attacks. Commerce and AEM the only products with a priority rating of 2 (threat actors have historically targeted Commerce).
Adobe has been using frontier AI models to hunt for flaws in its own code, which helps explain the higher volume of fixes. However, the company has still credited external researchers for many of the newly patched vulnerabilities.
While AI has helped Adobe find more vulnerabilities in its software, engineers still review, validate, and approve all AI-assisted code changes before deployment.
The rise in discoveries led Adobe to stop publishing security bulletins monthly. The company has moved to a twice-monthly schedule, on the second and fourth Tuesday of each month.
* Updated with information on Adobe Experience Manager patches. Headline and lede have been updated to include AEM vulnerability count
Related: Google Partially Reverses Chrome Bug Bounty Cuts
Related: Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
Related: Critical SonicWall Vulnerability Exploited Days After Disclosure
