Adobe Patches 140 Vulnerabilities Across 10 Products

What it is

Adobe released 10 advisories covering roughly 140 vulnerabilities. The page gives no CVE IDs, version numbers or advisory identifiers, so the details below are only the severity and impact characterizations it states.

Affected

Impact by product, as the page describes it:

What to do

Triage by exposure, not by flaw count.

1. Commerce first. It is the only priority 2 product, and the page says threat actors have historically targeted it. It also has the unauthenticated critical issues.
2. ColdFusion next. The page names critical code execution and privilege escalation here, but gives no authentication requirement for them.
3. Desktop and creative tools (Photoshop, Stager, Bridge and the others) are arbitrary code execution bugs, but Adobe rates them priority 3, meaning it does not expect them to be exploited. Patch them on the normal cycle.
4. Content Credentials SDK is a library, so check whether you embed it in your own builds. The page only says it is affected, not how it is distributed.

The page does not give fixed versions, so take them from the individual Adobe advisories.

Caveats

• Adobe says it knows of no in-the-wild exploitation.
• Adobe credited external researchers for many of the fixes, so the volume is not purely AI-found.
• The page says engineers review and approve all AI-assisted code changes before deployment.
• With bulletins now on the second and fourth Tuesday, the next two should fall on the next such Tuesdays. Plan patch windows around that cadence.