Patch days / September 2023

Adobe Security Updates — September 2023

Tuesday, 12 September 2023

Vulnerabilities: 21
Critical: 2
High: 12
Zero-days: 2
Public exploit: 0

Exploited 2

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

High 7.8
CVE-2023-26369 Zero-day [Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild
EPSS 7.5%
High 7.5
CVE-2023-38205 Zero-day ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298
EPSS 100%

Critical 2

Critical 9.8
CVE-2023-38204 Bypass APSB23-41 (CVE-2023-38203) - Pre-Auth RCE ColdFusion 2021 Update 8
EPSS 70%
Critical 9.1
CVE-2022-24093 Adobe Commerce post-auth improper input validation leads to remote code execution
EPSS 1.7%

All vulnerabilities 21

Critical2 Show

Critical 9.8
CVE-2023-38204 Bypass APSB23-41 (CVE-2023-38203) - Pre-Auth RCE ColdFusion 2021 Update 8
EPSS 70%
Critical 9.1
CVE-2022-24093 Adobe Commerce post-auth improper input validation leads to remote code execution
EPSS 1.7%

High12 Show

High 7.8
CVE-2023-26369 Zero-day [Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild
EPSS 7.5%
High 7.5
CVE-2023-38205 Zero-day ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298
EPSS 100%
High 7.8
CVE-2019-16470 CoolType.dll crash - Tianfu Cup
High 7.8
CVE-2019-16471 Use-After-Free in app.measureDialog - Tianfu Cup
High 7.8
CVE-2022-28831 Adobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
High 7.8
CVE-2022-28832 Adobe InDesign Font Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
High 7.8
CVE-2022-28833 Adobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
High 7.8
CVE-2022-28834 Adobe InCopy Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
High 7.8
CVE-2022-28835 Adobe InCopy Font Parsing Use-After-Free Remote Code Execution Vulnerability
High 7.8
CVE-2022-28836 Adobe InCopy Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
High 7.8
CVE-2022-34224 Adobe Acrobat Reader DC AcroForm setItems Use-After-Free Remote Code Execution Vulnerability
EPSS 3.3%
High 7.8
CVE-2022-34227 Adobe Acrobat Reader DC AcroForm value Use-After-Free Remote Code Execution Vulnerability
EPSS 3.1%

Medium7 Show