Adobe Security Updates — April 2025
Tuesday, 8 April 2025
Exploited 0
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
None of this release's vulnerabilities is known to be exploited so far.
Critical 4
- Critical 9.1 EPSS 1.8%
- Critical 9.1 EPSS 2.2%
- Critical 9.1 EPSS 24%
- Critical 9.1 EPSS 1.8%
All vulnerabilities 52
Critical4 ShowHide
- Critical 9.1 EPSS 1.8%
- Critical 9.1 EPSS 2.2%
- Critical 9.1 EPSS 24%
- Critical 9.1 EPSS 1.8%
High22 ShowHide
-
High 8.7
CVE-2025-30290 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 20%
- High 8.4 EPSS 2.1%
- High 8.4 EPSS 31%
-
High 8.4
CVE-2025-30286 ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 2.6%
- High 8.2 EPSS 2.9%
- High 8.2
-
High 8.2
CVE-2025-30289 ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 5.3%
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
Medium25 ShowHide
- Medium 6.8
- Medium 6.8 EPSS 17%
- Medium 6.1 EPSS 16%
- Medium 5.5
- Medium 5.5
- Medium 5.5
- Medium 5.5
- Medium 5.5
- Medium 5.5
- Medium 5.5
- Medium 5.5
- Medium 5.5
- Medium 5.5
- Medium 5.5
- Medium 5.5
- Medium 5.5
- Medium 5.5
- Medium 5.5
- Medium 5.5
- Medium 5.5
- Medium 5.4
- Medium 5.3
- Medium 5.3
- Medium 4.3
- Medium 4.3 EPSS 1%
Low1 ShowHide
- Low 2.7