Adobe Security Updates — June 2026

Tuesday, 9 June 2026

Vulnerabilities: 123
Critical: 4
High: 45
Zero-days: 0
Public exploit: 0

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 4

Critical 10.0
CVE-2026-47938 Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)
Critical 10.0
CVE-2026-48303 Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
Critical 9.6
CVE-2026-47928 ColdFusion | Improper Input Validation (CWE-20)
EPSS 2.1%
Critical 9.3
CVE-2026-34691 Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)

All vulnerabilities 123

Critical4 Show

Critical 10.0
CVE-2026-47938 Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)
Critical 10.0
CVE-2026-48303 Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
Critical 9.6
CVE-2026-47928 ColdFusion | Improper Input Validation (CWE-20)
EPSS 2.1%
Critical 9.3
CVE-2026-34691 Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)

High45 Show

High 8.8
CVE-2026-47932 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
EPSS 2.3%
High 8.6
CVE-2026-47906 Dreamweaver Desktop | Dependency on Vulnerable Third-Party Component (CWE-1395)
High 8.6
CVE-2026-47907 Dreamweaver Desktop | Improper Access Control (CWE-284)
High 8.4
CVE-2026-47929 ColdFusion | Incorrect Authorization (CWE-863)
EPSS 1.9%
High 8.4
CVE-2026-47931 ColdFusion | Improper Input Validation (CWE-20)
High 8.1
CVE-2026-47930 ColdFusion | Improper Input Validation (CWE-20)
High 8.0
CVE-2026-34693 Adobe Experience Manager Forms JEE | Cross-site Scripting (Reflected XSS) (CWE-79)
High 7.8
CVE-2026-34695 InDesign Desktop | Stack-based Buffer Overflow (CWE-121)
High 7.8
CVE-2026-34696 InDesign Desktop | Use After Free (CWE-416)
High 7.8
CVE-2026-34697 InDesign Desktop | Stack-based Buffer Overflow (CWE-121)
High 7.8
CVE-2026-34698 InDesign Desktop | Heap-based Buffer Overflow (CWE-122)
High 7.8
CVE-2026-34699 InDesign Desktop | Heap-based Buffer Overflow (CWE-122)
High 7.8
CVE-2026-34700 InDesign Desktop | Out-of-bounds Write (CWE-787)
High 7.8
CVE-2026-34701 InDesign Desktop | Heap-based Buffer Overflow (CWE-122)
High 7.8
CVE-2026-34702 InDesign Desktop | Stack-based Buffer Overflow (CWE-121)
High 7.8
CVE-2026-34706 InCopy | Out-of-bounds Write (CWE-787)
High 7.8
CVE-2026-34707 InCopy | Heap-based Buffer Overflow (CWE-122)
High 7.8
CVE-2026-34708 InCopy | Stack-based Buffer Overflow (CWE-121)
High 7.8
CVE-2026-34709 Substance3D - Sampler | Out-of-bounds Write (CWE-787)
High 7.8
CVE-2026-34710 Substance3D - Sampler | Out-of-bounds Write (CWE-787)
High 7.8
CVE-2026-47908 Dreamweaver Desktop | Access of Uninitialized Pointer (CWE-824)
High 7.8
CVE-2026-47911 Acrobat Reader | Out-of-bounds Write (CWE-787)
High 7.8
CVE-2026-47912 Acrobat Reader | Use After Free (CWE-416)
High 7.8
CVE-2026-47913 Acrobat Reader | Use After Free (CWE-416)
High 7.8
CVE-2026-47914 Acrobat Reader | Use After Free (CWE-416)
High 7.8
CVE-2026-47915 Acrobat Reader | Use After Free (CWE-416)
High 7.8
CVE-2026-47916 Acrobat Reader | Use After Free (CWE-416)
High 7.8
CVE-2026-47917 Acrobat Reader | Use After Free (CWE-416)
High 7.8
CVE-2026-47918 Acrobat Reader | Use After Free (CWE-416)
High 7.8
CVE-2026-47919 Acrobat Reader | Use After Free (CWE-416)
High 7.8
CVE-2026-47920 Acrobat Reader | Use After Free (CWE-416)
High 7.8
CVE-2026-47921 Acrobat Reader | Use After Free (CWE-416)
High 7.8
CVE-2026-47952 Acrobat Reader | Heap-based Buffer Overflow (CWE-122)
High 7.8
CVE-2026-47955 Acrobat Reader | Use After Free (CWE-416)
High 7.8
CVE-2026-47959 Acrobat Reader | Stack-based Buffer Overflow (CWE-121)
High 7.8
CVE-2026-48291 Format Plugins | Heap-based Buffer Overflow (CWE-122)
High 7.8
CVE-2026-48292 Format Plugins | Heap-based Buffer Overflow (CWE-122)
High 7.8
CVE-2026-48293 InDesign Desktop | Out-of-bounds Write (CWE-787)
High 7.8
CVE-2026-48305 Substance3D - Sampler | Out-of-bounds Write (CWE-787)
High 7.8
CVE-2026-48306 Substance3D - Sampler | Out-of-bounds Write (CWE-787)
High 7.7
CVE-2026-47937 Acrobat Reader | Uncontrolled Search Path Element (CWE-427)
High 7.5
CVE-2026-34711 CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)
High 7.5
CVE-2026-34712 CAI Content Credentials | Improper Input Validation (CWE-20)
High 7.5
CVE-2026-34713 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
High 7.4
CVE-2026-47960 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

Medium72 Show

Low2 Show