Adobe Security Updates — July 2026

Exploited 1

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

• Critical 9.3
  CVE-2026-48356 Exploited Public exploit Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
  EPSS 47%

Critical 12

• Critical 9.9
  CVE-2026-48318 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
  EPSS 1.1%
• Critical 9.9
  CVE-2026-48322 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
  EPSS 1.2%
• Critical 9.6
  CVE-2026-48259 Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)
• Critical 9.6
  CVE-2026-48284 ColdFusion | Improper Input Validation (CWE-20)
• Critical 9.6
  CVE-2026-48359 Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
  EPSS 1%
• Critical 9.3
  CVE-2026-48321 ColdFusion | Incorrect Authorization (CWE-863)
• Critical 9.3
  CVE-2026-48325 ColdFusion | Missing Authentication for Critical Function (CWE-306)
• Critical 9.3
  CVE-2026-48334 Illustrator | Improper Input Validation (CWE-20)
  EPSS 1%
• Critical 9.1
  CVE-2026-48319 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
  EPSS 1.4%
• Critical 9.1
  CVE-2026-48324 ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
  EPSS 1.1%
• Critical 9.1
  CVE-2026-48358 Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116)
  EPSS 1.2%
• Critical 9.0
  CVE-2026-48327 ColdFusion | Incorrect Authorization (CWE-863)

All vulnerabilities 90