Adobe Security Updates — September 2025

Exploited 1

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

• Critical 9.1
  CVE-2025-54236 Exploited Public exploit Adobe Commerce | Improper Input Validation (CWE-20)
  EPSS 95%

Critical 1

• Critical 10.0
  CVE-2025-54261 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
  EPSS 26%

All vulnerabilities 22