Adobe Security Updates — December 2025

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 6

• Critical 9.3
  CVE-2025-64537 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
• Critical 9.3
  CVE-2025-64538 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
• Critical 9.3
  CVE-2025-64539 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
• Critical 9.1
  CVE-2025-61808 ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)
  EPSS 11%
• Critical 9.1
  CVE-2025-61809 ColdFusion | Improper Input Validation (CWE-20)
• Critical 9.1
  CVE-2025-61811 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
  EPSS 1.2%

All vulnerabilities 135