Advisories
Adobe April 2026 Patch Tuesday: 61 CVEs, 12 Bulletins, Critical Reader & ColdFusion Patches
Adobe released 12 security bulletins covering 61 CVEs across multiple products, with the most urgent patches for Acrobat Reader and ColdFusion. Defenders should apply these updates immediately and verify that vulnerable versions are no longer in use.
What Happened
Adobe released 12 security bulletins covering 61 CVEs across Acrobat Reader, InDesign, InCopy, FrameMaker, Connect, ColdFusion, Bridge, Photoshop, Illustrator, Experience Manager Screens, and the DNG SDK. Three ColdFusion bugs were reported via TrendAI ZDI.
Impact
Critical vulnerabilities (CVSS 8.6–9.6) affect Acrobat Reader (two CVEs) and ColdFusion (one CVE). The highest priority patches target Acrobat Reader and ColdFusion. Other products have lower severity but still require attention.
What to Do
- Apply the Acrobat Reader patches immediately; monitor for exploitation attempts.
- Update ColdFusion to the latest release; verify that the CVE is mitigated.
- Deploy remaining patches for InDesign, InCopy, FrameMaker, Connect, Bridge, Photoshop, Illustrator, Experience Manager Screens, and DNG SDK as per your deployment schedule.
- Validate that your systems are not running vulnerable versions; use automated scanning tools.
- Review logs for anomalous activity related to the known exploits.
Additional Notes
Adobe’s TrendAI ZDI program continues to surface critical issues; keep the program enabled and review the advisory list regularly.
Related vulnerabilities
Adobe June 2026 Patch Tuesday: 11 Bulletins, 123 CVEs, CVSS 10.0 in Campaign Classic
Adobe released 11 security bulletins in June 2026, addressing 123 CVEs across multiple products. The highest severity CVSS 10.0 is in Campaign Classic, with other critical CVEs in ColdFusion and Acrobat Reader. Defenders should prioritize patching Campaign Classic first, then ColdFusion and Acrobat Reader, and monitor for exploitation.
Read briefing
JPCERT/CC Issues Alert for Critical Arbitrary Code Execution Flaws in Adobe Acrobat and Reader (APSB26-141)
JPCERT/CC has published an advisory regarding critical vulnerabilities in Adobe Acrobat and Reader across Windows and macOS platforms. Successful exploitation could allow an attacker to execute arbitrary code via malicious PDF content. Defenders must immediately apply the latest software updates provided by Adobe.
Read briefing
Microsoft September 2026 Patch Tuesday Addresses Record 974 Vulnerabilities
Microsoft's September 2026 Patch Tuesday marks its largest security update to date, addressing 974 vulnerabilities, including two actively exploited zero-days. Sysadmins and SecOps teams must prioritize the deployment of fixes covering critical components like Hyper-V, Windows HTTP.sys, and Exchange Server. Additionally, Adobe released advisories covering 170 vulnerabilities across its product ecosystem.
Read briefing
Multiple Privilege Escalation and RCE Vulnerabilities in Adobe, Apple, Foxit, and Windows Disclosed
Cisco Talos researchers uncovered a series of critical bugs that enable privilege escalation or remote code execution across Adobe Photoshop, Apple macOS, Foxit Reader, and Microsoft Windows. Patches are available and defenders should apply them immediately while monitoring for exploitation attempts.
Read briefing