Adobe Closes 89 Security Vulnerabilities in July Patch

On July 12, 2026, Adobe closed a total of 89 security vulnerabilities in various software products as part of its monthly Patch Day. The affected applications include After Effects, Animate, Audition, Bridge, ColdFusion, Commerce, Magento, Creative Cloud Desktop App, Experience Manager (AEM), Illustrator, Media Encoder, and Premiere. Of the 89 vulnerabilities, 63 are classified as critical. This classification indicates that attacks exploiting these vulnerabilities could have potentially severe consequences.

However, no attacks exploiting these vulnerabilities are currently known. For most updates, Adobe has assigned the lowest urgency level of 3, while ColdFusion has the highest priority level of 1. In ColdFusion, 13 vulnerabilities were fixed, 12 of which are critical. Adobe strongly recommends using the latest MySQL Java Connector to minimize security risks. Additionally, the company refers to its filter documentation, which describes protective measures against deserialization attacks.

The Commerce and Magento solutions received updates addressing 14 vulnerabilities, 8 of which are classified as critical. The most dangerous vulnerability is CVE-2026-48356, which has a CVSS score of 9.6. An attacker could upload files with malicious code without user authentication, which could then be executed automatically. In Adobe Experience Manager (AEM), 13 security vulnerabilities were closed, including 4 critical ones. Nine of the vulnerabilities are classified as high-risk and particularly affect XSS vulnerabilities (Cross-Site Scripting).

Some of these vulnerabilities affect only the AEM Cloud Service. In the video editing software Premiere and Premiere Pro, Adobe closed 4 vulnerabilities, 3 of which are classified as critical and allow for Remote Code Execution (RCE). In Media Encoder, 5 vulnerabilities were fixed, 4 of which are RCE vulnerabilities. Adobe has changed its update strategy and now offers two update dates per month, falling on the second and fourth Tuesday of the month.

This measure aims to ensure that users are regularly provided with the latest security updates. The security updates affect both Windows and macOS or are cross-platform. Adobe has clearly communicated the urgency of the updates to help users secure their systems in a timely manner. The security vulnerabilities in Adobe products are a serious issue affecting both businesses and individuals. Adobe has emphasized that users should always keep their software up to date to minimize security risks. The next update round is scheduled for July 26, 2026.