Adobe Security Updates — May 2025
Tuesday, 13 May 2025
Exploited 0
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
None of this release's vulnerabilities is known to be exploited so far.
Critical 7
- Critical 9.3
- Critical 9.1 EPSS 17%
- Critical 9.1 EPSS 1.6%
- Critical 9.1 EPSS 23%
- Critical 9.1 EPSS 24%
-
Critical 9.1
CVE-2025-43562 ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 51%
- Critical 9.1 EPSS 17%
All vulnerabilities 40
Critical7 ShowHide
- Critical 9.3
- Critical 9.1 EPSS 17%
- Critical 9.1 EPSS 1.6%
- Critical 9.1 EPSS 23%
- Critical 9.1 EPSS 24%
-
Critical 9.1
CVE-2025-43562 ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 51%
- Critical 9.1 EPSS 17%
High25 ShowHide
- High 8.4 EPSS 18%
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
- High 7.8
Medium8 ShowHide
-
Medium 6.8
CVE-2025-43566 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 58%
- Medium 6.1
- Medium 6.1
- Medium 5.5
- Medium 5.5
- Medium 5.5
- Medium 5.5
- Medium 5.4