Adobe rolls out urgent security updates for 13 products

Adobe is urging Creative Cloud users to update their software after dangerous vulnerabilities were uncovered.

Adobe has patched over 60 vulnerabilities, many of which were rated as critical across 13 products in Adobe Creative Cloud. The vulnerabilities were revealed by security researchers participating in Adobe’s public bug bounty program with HackerOne.

Adobe claims that it is not aware of “any exploits in the wild” for any of the issues addressed in the current updates. Most of the patched flaws could’ve let hackers run their own code, while others might have crashed Adobe apps, risking lost work or scrambled project files. In the worst-case scenarios, it could assist attackers in installing malware, stealing files, or taking control.

Among the updates, Adobe has pushed out fixes for Adobe Commerce and Magento Open Source, fixing several serious vulnerabilities that could let hackers take over accounts, read private files, or even knock an online store offline.

The updates target Adobe Commerce and Magento versions 2.4.9-alpha1 and earlier, covering both standard and business editions. While Adobe hasn’t spotted any attackers exploiting these flaws yet, hackers often target Magento sites, so store owners should install security patches.

In 2024, a hacking campaign breached 4,275 online stores, including Ray-Ban, National Geographic, Cisco, Whirlpool, and Segway. Attackers exploited a critical vulnerability affecting Adobe Commerce and Magento software.

The company recommends that all users update their software to the newest version via the Creative Cloud desktop app’s update mechanism. The current load of patches comes after critical vulnerabilities were found in Adobe Acrobat Reader in July.

What vulnerabilities did Adobe fix in its products?

• Adobe Animate: Two vulnerabilities, a critical code execution flaw and a memory leak vulnerability.
• Adobe Illustrator: Three code execution vulnerabilities and one denial-of-service flaw
• Adobe Photoshop: One critical code execution vulnerability.
• Adobe InDesign: 11 critical code execution and three memory leak vulnerabilities.
• Adobe InCopy: Eight critical code execution vulnerabilities.
• Adobe Dimension: One memory leak vulnerability
• Adobe FrameMaker: Four critical code execution and one memory leak vulnerability.
• Adobe Substance 3D Viewer: Two critical code execution vulnerabilities
• Adobe Substance 3D Modeler: Three critical code execution and ten memory leak vulnerabilities.
• Adobe Substance 3D Painter: One critical code execution and eight memory leak vulnerabilities.
• Adobe Substance 3D stager: One critical code execution and one memory leak vulnerability.
• Substance 3D Sampler: One memory leak vulnerability.