Adobe Issues 12 Security Advisories Addressing 89 Vulnerabilities Across Multiple Products
Adobe has published 12 security advisories addressing a combined total of 89 vulnerabilities across multiple products and SDKs. The release occurred on July 14, 2026, coinciding with the regular monthly Patch Tuesday cycle.
The advisories cover Adobe ColdFusion, Adobe Commerce, Adobe Experience Manager, Adobe Illustrator, and additional applications such as Audition, Premiere Pro, After Effects, Animate, Media Encoder, Bridge, and the Creative Cloud Desktop Application, along with the Content Credentials SDK.
All vulnerabilities are rated at the highest severity level of Critical. Several flaws in Adobe ColdFusion, Adobe Commerce, Adobe Experience Manager, and Adobe Illustrator carry CVSS v3.1 base scores of 9.0 or above.
Adobe ColdFusion received the highest remediation priority rating of 1, with a recommended response window of 72 hours. Adobe Commerce was assigned priority 2, indicating a 30-day update target. All other products were given priority 3, allowing updates at any convenient time.
No exploitation of the disclosed vulnerabilities had been confirmed at the time of publication.
Affected Products and CVE Identifiers
Adobe ColdFusion (13 CVEs): CVE-2026-48284, CVE-2026-48318, CVE-2026-48319, CVE-2026-48320, CVE-2026-48321, CVE-2026-48322, CVE-2026-48324, CVE-2026-48325, CVE-2026-48327, CVE-2026-48328, CVE-2026-48329, CVE-2026-48332, CVE-2026-48338.
Adobe Commerce (15 CVEs): CVE-2026-47984, CVE-2026-47988, CVE-2026-47992, CVE-2026-47994, CVE-2026-47995, CVE-2026-47996, CVE-2026-47997, CVE-2026-47998, CVE-2026-47999, CVE-2026-48000, CVE-2026-48001, CVE-2026-48356, CVE-2026-48358, CVE-2026-48371.
Adobe Experience Manager (13 CVEs) and additional CVEs for Audition, Premiere Pro, After Effects, Animate, Illustrator, Media Encoder, Bridge, Creative Cloud Desktop Application, and Content Credentials SDK complete the list of 89 vulnerabilities.
Related articles
Liferay Community Edition Misconfiguration Exposes Plaintext Passwords in Government Systems via CWE-319
A detailed analysis reveals how the use of Liferay Community Edition in a closed government information system led to the transmission of user passwords in plaintext through transactional emails. The issue stemmed from default notification templates that included the [$PASSWORD$] macro, combined with unadjusted system variables pointing to localhost instead of the production domain. Despite proper OAuth 2.0 delegation and CSRF protections, the misconfigured password change workflow sent permanent credentials in clear text to user inboxes. The root cause was traced to custom portlets that incorrectly reused the New Password Notification trigger intended only for administrator-initiated resets. Remediation involves removing the password macro from email templates and updating portal-ext.properties to enforce production host settings. The case highlights how open-source enterprise platforms require thorough hardening beyond initial code audits when deployed in high-security environments.
GitLab Critical Vulnerabilities Traced to Ruby Onigmo Regex Engine, Including Exploited CVE-2026-97229
GitLab has disclosed that four critical vulnerabilities, including the already-exploited CVE-2026-97229, originate from flaws in the Ruby programming language's Onigmo regular expression engine rather than in GitLab code itself. The most severe issue, CVE-2026-97229, is an integer overflow in regex processing within CI/CD configuration files and carries a maximum CVSSv3.1 base score of 10.0. GitLab released patches on October 8, 2026, covering versions 19.4.2, 19.3.5, and 19.2.8. Ruby's development team followed with its own advisory on October 23, 2026, addressing the same underlying defects. The remaining three vulnerabilities involve double-free memory errors and additional integer overflows during regex parsing and compilation. Because the root cause lies in a shared dependency, any application or environment relying on the affected Ruby Onigmo engine may also be exposed.
CISA Adds Cisco Secure Firewall and GitLab Flaws to Known Exploited Vulnerabilities Catalog
US authorities have warned that two vulnerabilities in Cisco Systems firewall products and the GitLab development platform are being actively exploited in the wild. The Cybersecurity and Infrastructure Security Agency added CVE-2026-76418 and CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on October 29, 2026, urging immediate remediation. CVE-2026-76418 affects Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, allowing unauthenticated attackers to trigger device reboots and cause denial-of-service conditions. CVE-2026-97229 is an integer overflow in GitLab stemming from insufficient validation of regular expressions in CI/CD configurations, enabling remote code execution without authentication. CISA noted that the GitLab issue originates from a dependency in Ruby/Onigmo and may impact other products beyond GitLab itself. Organizations are advised to apply patches or mitigations without delay to prevent further exploitation.
Cisco ASA and FTD Face DoS Vulnerability in SSL VPN Already Exploited in the Wild
Cisco Systems has disclosed a denial-of-service vulnerability affecting its Cisco Secure Firewall ASA and Cisco Secure Firewall FTD products. The flaw, tracked as CVE-2026-76418, resides in the SSL VPN remote access feature and carries a CVSS v3.1 base score of 8.6, rated High severity. Exploitation occurs when secondary authentication is configured on tunnel groups, allowing an attacker to send a crafted request that forces a device reboot without requiring authentication. Cisco confirmed active exploitation of the issue in October 2026. Security updates addressing the vulnerability are now available for both affected product lines. The advisory recommends immediate application of the patches to prevent service disruption.