Adobe vulnerabilities
We track 1,726 vulnerabilities in Adobe products across 60+ products. 1,723 are rated high or critical, and 83 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest Adobe vulnerabilities
- 8.6 High severity
Illustrator is affected by an Improper Input Validation vulnerability that could result in…
Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires
- 8.6 High severity
Illustrator Desktop 2026: Incorrect Authorization
Illustrator is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires us
- 7.8 High severity
Photoshop 2026: Integer Overflow or Wraparound
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- 7.8 High severity
Photoshop 2026: Integer Overflow or Wraparound
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- 7.8 High severity
Photoshop 2026: Integer Overflow or Wraparound
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- 9.1 Critical severity
ColdFusion 2025: Improper Neutralization of Special Elements used in an SQL Command
ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit thi
- 7.8 High severity
Photoshop 2026: Out-of-bounds Write
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- 9.9 Critical severity
ColdFusion 2025: Improper Neutralization of Directives in Dynamically Evaluated Code
ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vul
- 9.9 Critical severity
Adobe Experience Manager as a Cloud Service: Incorrect Authorization
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. A low-privil
- 10.0 Critical severity
Adobe Campaign Classic: Improper Neutralization of Special Elements used in an OS Command
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit
- 8.6 High severity
Adobe Commerce: Incorrect Authorization
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does
- 8.7 High severity
Adobe Commerce: Incorrect Authorization
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to bypass security measures and gain unauthorized write access, causing a
- 7.6 High severity
Adobe Commerce: Improper Limitation of a Pathname to a Restricted Directory
Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to access unauthori
- 8.6 High severity
Adobe Commerce: Incorrect Authorization
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to restricted resources. Exploitation of this issue does not require user in
- 7.5 High severity
Adobe Commerce: Incorrect Authorization
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive information. Exploitation of this issue does not require user i
- 8.2 High severity
Adobe Commerce: Incorrect Authorization
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive information. Exploitation of this issue does not require user i
- 9.3 Critical severity
Adobe Commerce: Improper Neutralization of Input During Web Page Generation
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page
- 9.3 Critical severity
Adobe Commerce: Improper Neutralization of Input During Web Page Generation
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page
- 7.4 High severity
Photoshop Android: Session Fixation
Photoshop Mobile is affected by a Session Fixation vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain access to sensitive resources. Exploit depends on conditions beyond the attacker's control. Exploi
- 8.2 High severity
Adobe Animate 2023: Improper Control of Generation of Code
Animate is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary
- 10.0 Critical severity
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Exploited
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbit
- 7.8 High severity
Adobe Substance 3D Sampler: Heap-based Buffer Overflow
Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- 7.1 High severity
ColdFusion 2025: Improper Authentication
ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain limited read and write access. The vulnerable component is restricted to an administrative netwo
- 7.8 High severity
Adobe Substance 3D Sampler: Heap-based Buffer Overflow
Substance3D - Sampler versions 5.1.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim
- 10.0 Critical severity
Adobe Campaign Classic: Improper Neutralization of Special Elements used in an OS Command
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit
- 10.0 Critical severity
Adobe Campaign Classic: Improper Neutralization of Special Elements used in an OS Command
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit
- 10.0 Critical severity
Adobe Campaign Classic: Server-Side Request Forgery
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitatio
- 7.8 High severity
Substance3D - Painter: Out-of-bounds Write
Substance3D - Painter is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- 7.8 High severity
Substance3D - Painter: Heap-based Buffer Overflow
Substance3D - Painter is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- 7.8 High severity
Substance3D - Painter: Untrusted Search Path
Substance3D - Painter is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue req
- 7.8 High severity
Substance3D - Painter: Heap-based Buffer Overflow
Substance3D - Painter is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- 7.8 High severity
Substance3D - Painter: Heap-based Buffer Overflow
Substance3D - Painter is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- 7.8 High severity
Substance3D - Painter: Heap-based Buffer Overflow
Substance3D - Painter is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- 7.8 High severity
Substance3D - Painter: Out-of-bounds Write
Substance3D - Painter is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- 7.8 High severity
Adobe Substance 3D Designer: Out-of-bounds Write
Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- 7.5 High severity
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could…
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitati
- 7.5 High severity
C2PA Tool: Integer Underflow (Wrap or Wraparound)
CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service conditio
- 7.8 High severity
Adobe XD: Buffer Copy without Checking Size of Input
Adobe XD is affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interacti
- 7.8 High severity
Adobe Substance 3D Sampler: Out-of-bounds Write
Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- 7.5 High severity
C2PA Tool: Uncontrolled Resource Consumption
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service