<?xml version="1.0" encoding="UTF-8"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Patchfirst: Adobe vulnerabilities</title><link>https://patchfirst.co/vendor/adobe/</link><atom:link href="https://patchfirst.co/feed/vendor/adobe.xml" rel="self" type="application/rss+xml"/><description>New and newly exploited Adobe CVEs, with CISA KEV, EPSS and ATT&amp;CK context. Newest 50 by publication or KEV listing.</description><language>en-gb</language><ttl>360</ttl><lastBuildDate>Sat, 31 Oct 2026 05:11:25 GMT</lastBuildDate><item><title>[KEV] CVE-2026-48356: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability</title><link>https://patchfirst.co/cve/CVE-2026-48356/</link><guid isPermaLink="false">CVE-2026-48356#kev</guid><pubDate>Tue, 27 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Commerce and Magento. In CISA KEV since 2026-10-27. ENISA EUVD lists it as exploited. EPSS 44.6% (higher than 98.8% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. ATT&amp;CK: T1189 Drive-by Compromise; T1059 Command and Scripting Interpreter. Priority 78.3 of 100.</description><category>kev</category><category>public-exploit</category><category>T1189</category><category>T1059</category></item><item><title>CVE-2026-104353: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command (&apos;OS…</title><link>https://patchfirst.co/cve/CVE-2026-104353/</link><guid isPermaLink="false">CVE-2026-104353</guid><pubDate>Tue, 27 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Campaign Classic. Not in CISA KEV. EPSS 1.3% (higher than 70.4% of CVEs). CVSS 9.9 CRITICAL. Priority 22.1 of 100.</description></item><item><title>CVE-2026-104351: Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code (&apos;Code Injection&apos;) vulnerability…</title><link>https://patchfirst.co/cve/CVE-2026-104351/</link><guid isPermaLink="false">CVE-2026-104351</guid><pubDate>Tue, 27 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Campaign Classic. Not in CISA KEV. EPSS 0.6% (higher than 47.3% of CVEs). CVSS 9.9 CRITICAL. Priority 17.5 of 100.</description></item><item><title>CVE-2026-104350: Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability</title><link>https://patchfirst.co/cve/CVE-2026-104350/</link><guid isPermaLink="false">CVE-2026-104350</guid><pubDate>Tue, 27 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Campaign Classic. Not in CISA KEV. EPSS 0.6% (higher than 48.9% of CVEs). CVSS 9.3 CRITICAL. Priority 17.4 of 100.</description></item><item><title>CVE-2026-105781: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…</title><link>https://patchfirst.co/cve/CVE-2026-105781/</link><guid isPermaLink="false">CVE-2026-105781</guid><pubDate>Tue, 27 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Campaign Classic. Not in CISA KEV. EPSS 0.5% (higher than 44% of CVEs). CVSS 10.0 CRITICAL. Priority 16.9 of 100.</description></item><item><title>CVE-2026-105780: Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary…</title><link>https://patchfirst.co/cve/CVE-2026-105780/</link><guid isPermaLink="false">CVE-2026-105780</guid><pubDate>Tue, 27 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Campaign Classic. Not in CISA KEV. EPSS 0.5% (higher than 42.1% of CVEs). CVSS 9.9 CRITICAL. Priority 16.4 of 100.</description></item><item><title>CVE-2026-105489: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…</title><link>https://patchfirst.co/cve/CVE-2026-105489/</link><guid isPermaLink="false">CVE-2026-105489</guid><pubDate>Tue, 27 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Campaign Classic. Not in CISA KEV. EPSS 0.5% (higher than 41.1% of CVEs). CVSS 9.9 CRITICAL. Priority 16.2 of 100.</description></item><item><title>CVE-2026-48360: Adobe Connect is affected by an Improper Control of Generation of Code (&apos;Code Injection&apos;) vulnerability that could…</title><link>https://patchfirst.co/cve/CVE-2026-48360/</link><guid isPermaLink="false">CVE-2026-48360</guid><pubDate>Tue, 27 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Connect Desktop App. Not in CISA KEV. EPSS 0.4% (higher than 39.1% of CVEs). CVSS 9.6 CRITICAL. Priority 16.1 of 100.</description></item><item><title>CVE-2026-104354: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…</title><link>https://patchfirst.co/cve/CVE-2026-104354/</link><guid isPermaLink="false">CVE-2026-104354</guid><pubDate>Tue, 27 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Campaign Classic. Not in CISA KEV. EPSS 0.5% (higher than 42.5% of CVEs). CVSS 9.1 CRITICAL. Priority 16.0 of 100.</description></item><item><title>CVE-2026-105779: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…</title><link>https://patchfirst.co/cve/CVE-2026-105779/</link><guid isPermaLink="false">CVE-2026-105779</guid><pubDate>Tue, 27 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Campaign Classic. Not in CISA KEV. EPSS 0.3% (higher than 22.2% of CVEs). CVSS 9.1 CRITICAL. Priority 11.9 of 100.</description></item><item><title>CVE-2026-103849: Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability…</title><link>https://patchfirst.co/cve/CVE-2026-103849/</link><guid isPermaLink="false">CVE-2026-103849</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Commerce. Not in CISA KEV. EPSS 1.2% (higher than 67.4% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 27.6 of 100.</description><category>public-exploit</category></item><item><title>CVE-2026-103848: Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command (&apos;OS…</title><link>https://patchfirst.co/cve/CVE-2026-103848/</link><guid isPermaLink="false">CVE-2026-103848</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Experience Manager 6.5 LTS. Not in CISA KEV. EPSS 1.4% (higher than 72.6% of CVEs). CVSS 9.9 CRITICAL. Priority 23.6 of 100.</description></item><item><title>CVE-2026-90531: Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference (&apos;XXE&apos;) vulnerability…</title><link>https://patchfirst.co/cve/CVE-2026-90531/</link><guid isPermaLink="false">CVE-2026-90531</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Experience Manager as a Cloud Service. Not in CISA KEV. EPSS 1.4% (higher than 72.5% of CVEs). CVSS 9.6 CRITICAL. Priority 23.4 of 100.</description></item><item><title>CVE-2026-106624: ColdFusion is affected by an Improper Control of Generation of Code (&apos;Code Injection&apos;) vulnerability that could result…</title><link>https://patchfirst.co/cve/CVE-2026-106624/</link><guid isPermaLink="false">CVE-2026-106624</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · ColdFusion 2025. Not in CISA KEV. EPSS 1.1% (higher than 65.9% of CVEs). CVSS 10.0 CRITICAL. Priority 22.4 of 100.</description></item><item><title>CVE-2026-105899: ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in…</title><link>https://patchfirst.co/cve/CVE-2026-105899/</link><guid isPermaLink="false">CVE-2026-105899</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · ColdFusion 2025. Not in CISA KEV. EPSS 1.0% (higher than 64.1% of CVEs). CVSS 10.0 CRITICAL. Priority 22.0 of 100.</description></item><item><title>CVE-2026-48383: Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code…</title><link>https://patchfirst.co/cve/CVE-2026-48383/</link><guid isPermaLink="false">CVE-2026-48383</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Experience Manager as a Cloud Service. Not in CISA KEV. EPSS 1.0% (higher than 61.9% of CVEs). CVSS 10.0 CRITICAL. Priority 21.6 of 100.</description></item><item><title>CVE-2026-48382: Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code…</title><link>https://patchfirst.co/cve/CVE-2026-48382/</link><guid isPermaLink="false">CVE-2026-48382</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Experience Manager as a Cloud Service. Not in CISA KEV. EPSS 1.0% (higher than 61.9% of CVEs). CVSS 10.0 CRITICAL. Priority 21.6 of 100.</description></item><item><title>CVE-2026-100133: Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to…</title><link>https://patchfirst.co/cve/CVE-2026-100133/</link><guid isPermaLink="false">CVE-2026-100133</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Commerce. Not in CISA KEV. EPSS 1.0% (higher than 64.2% of CVEs). CVSS 9.3 CRITICAL. Priority 21.5 of 100.</description></item><item><title>CVE-2026-83662: Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability</title><link>https://patchfirst.co/cve/CVE-2026-83662/</link><guid isPermaLink="false">CVE-2026-83662</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Experience Manager as a Cloud Service. Not in CISA KEV. EPSS 1.0% (higher than 63.6% of CVEs). CVSS 9.3 CRITICAL. Priority 21.4 of 100.</description></item><item><title>CVE-2026-106621: ColdFusion is affected by an Improper Control of Generation of Code (&apos;Code Injection&apos;) vulnerability that could result…</title><link>https://patchfirst.co/cve/CVE-2026-106621/</link><guid isPermaLink="false">CVE-2026-106621</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · ColdFusion 2025. Not in CISA KEV. EPSS 0.9% (higher than 60.4% of CVEs). CVSS 9.1 CRITICAL. Priority 20.6 of 100.</description></item><item><title>CVE-2026-90532: Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code…</title><link>https://patchfirst.co/cve/CVE-2026-90532/</link><guid isPermaLink="false">CVE-2026-90532</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Experience Manager as a Cloud Service. Not in CISA KEV. EPSS 0.8% (higher than 57.4% of CVEs). CVSS 10.0 CRITICAL. Priority 20.6 of 100.</description></item><item><title>CVE-2026-91013: Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to…</title><link>https://patchfirst.co/cve/CVE-2026-91013/</link><guid isPermaLink="false">CVE-2026-91013</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Commerce. Not in CISA KEV. EPSS 0.9% (higher than 59.3% of CVEs). CVSS 9.3 CRITICAL. Priority 20.5 of 100.</description></item><item><title>CVE-2026-106622: ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation</title><link>https://patchfirst.co/cve/CVE-2026-106622/</link><guid isPermaLink="false">CVE-2026-106622</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · ColdFusion 2025. Not in CISA KEV. EPSS 0.8% (higher than 56.4% of CVEs). CVSS 10.0 CRITICAL. Priority 20.4 of 100.</description></item><item><title>CVE-2026-106630: Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an…</title><link>https://patchfirst.co/cve/CVE-2026-106630/</link><guid isPermaLink="false">CVE-2026-106630</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Experience Manager 6.5 LTS. Not in CISA KEV. EPSS 0.9% (higher than 58.9% of CVEs). CVSS 9.3 CRITICAL. Priority 20.4 of 100.</description></item><item><title>CVE-2026-106629: Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an…</title><link>https://patchfirst.co/cve/CVE-2026-106629/</link><guid isPermaLink="false">CVE-2026-106629</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Experience Manager 6.5 LTS. Not in CISA KEV. EPSS 0.9% (higher than 58.9% of CVEs). CVSS 9.3 CRITICAL. Priority 20.4 of 100.</description></item><item><title>CVE-2026-92909: Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution…</title><link>https://patchfirst.co/cve/CVE-2026-92909/</link><guid isPermaLink="false">CVE-2026-92909</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Commerce. Not in CISA KEV. EPSS 0.8% (higher than 56.4% of CVEs). CVSS 9.8 CRITICAL. Priority 20.3 of 100.</description></item><item><title>CVE-2026-92464: Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution…</title><link>https://patchfirst.co/cve/CVE-2026-92464/</link><guid isPermaLink="false">CVE-2026-92464</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Commerce. Not in CISA KEV. EPSS 0.9% (higher than 58.7% of CVEs). CVSS 9.1 CRITICAL. Priority 20.3 of 100.</description></item><item><title>CVE-2026-75732: Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code…</title><link>https://patchfirst.co/cve/CVE-2026-75732/</link><guid isPermaLink="false">CVE-2026-75732</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Experience Manager 6.5 LTS. Not in CISA KEV. EPSS 0.7% (higher than 53.6% of CVEs). CVSS 9.9 CRITICAL. Priority 19.8 of 100.</description></item><item><title>CVE-2026-105895: Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code…</title><link>https://patchfirst.co/cve/CVE-2026-105895/</link><guid isPermaLink="false">CVE-2026-105895</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Experience Manager 6.5. Not in CISA KEV. EPSS 0.7% (higher than 53.4% of CVEs). CVSS 9.9 CRITICAL. Priority 19.8 of 100.</description></item><item><title>CVE-2026-106626: Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code…</title><link>https://patchfirst.co/cve/CVE-2026-106626/</link><guid isPermaLink="false">CVE-2026-106626</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Experience Manager as a Cloud Service. Not in CISA KEV. EPSS 0.7% (higher than 54.5% of CVEs). CVSS 9.1 CRITICAL. Priority 19.4 of 100.</description></item><item><title>CVE-2026-105903: ColdFusion is affected by an Improper Control of Generation of Code (&apos;Code Injection&apos;) vulnerability that could result…</title><link>https://patchfirst.co/cve/CVE-2026-105903/</link><guid isPermaLink="false">CVE-2026-105903</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · ColdFusion 2025. Not in CISA KEV. EPSS 0.6% (higher than 50.4% of CVEs). CVSS 9.9 CRITICAL. Priority 19.2 of 100.</description></item><item><title>CVE-2026-106612: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in…</title><link>https://patchfirst.co/cve/CVE-2026-106612/</link><guid isPermaLink="false">CVE-2026-106612</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · ColdFusion 2025. Not in CISA KEV. EPSS 0.5% (higher than 44.3% of CVEs). CVSS 9.9 CRITICAL. Priority 18.0 of 100.</description></item><item><title>CVE-2026-106620: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass</title><link>https://patchfirst.co/cve/CVE-2026-106620/</link><guid isPermaLink="false">CVE-2026-106620</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · ColdFusion 2025. Not in CISA KEV. EPSS 0.4% (higher than 36.1% of CVEs). CVSS 9.6 CRITICAL. Priority 16.1 of 100.</description></item><item><title>CVE-2026-90530: ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory (&apos;Path Traversal&apos;)…</title><link>https://patchfirst.co/cve/CVE-2026-90530/</link><guid isPermaLink="false">CVE-2026-90530</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · ColdFusion 2025. Not in CISA KEV. EPSS 0.3% (higher than 27.4% of CVEs). CVSS 9.3 CRITICAL. Priority 14.2 of 100.</description></item><item><title>CVE-2026-75994: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in…</title><link>https://patchfirst.co/cve/CVE-2026-75994/</link><guid isPermaLink="false">CVE-2026-75994</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><description>Adobe · ColdFusion 2025. Not in CISA KEV. EPSS 0.3% (higher than 25.4% of CVEs). CVSS 9.6 CRITICAL. Priority 14.0 of 100.</description></item><item><title>[KEV] CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability</title><link>https://patchfirst.co/cve/CVE-2026-71362/</link><guid isPermaLink="false">CVE-2026-71362#kev</guid><pubDate>Thu, 24 Sep 2026 00:00:00 GMT</pubDate><description>Adobe · Commerce and Magento . In CISA KEV since 2026-09-24. ENISA EUVD lists it as exploited. EPSS 90.5% (higher than 99.8% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&amp;CK: T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation. Priority 79.3 of 100.</description><category>kev</category><category>public-exploit</category><category>T1190</category><category>T1068</category></item><item><title>[KEV] CVE-2026-75650: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability</title><link>https://patchfirst.co/cve/CVE-2026-75650/</link><guid isPermaLink="false">CVE-2026-75650#kev</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate><description>Adobe · Commerce and Magento. In CISA KEV since 2026-09-08. ENISA EUVD lists it as exploited. EPSS 3.9% (higher than 90.4% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&amp;CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.1 of 100.</description><category>kev</category><category>public-exploit</category><category>T1190</category><category>T1059</category></item><item><title>[KEV] CVE-2026-48282: Adobe ColdFusion Path Traversal Vulnerability</title><link>https://patchfirst.co/cve/CVE-2026-48282/</link><guid isPermaLink="false">CVE-2026-48282#kev</guid><pubDate>Tue, 07 Jul 2026 00:00:00 GMT</pubDate><description>Adobe · ColdFusion. In CISA KEV since 2026-07-07. ENISA EUVD lists it as exploited. EPSS 42.4% (higher than 98.7% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&amp;CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 74.7 of 100.</description><category>kev</category><category>public-exploit</category><category>T1190</category><category>T1059</category></item><item><title>CVE-2026-48313: ColdFusion | Improper Limitation of a Pathname to a Restricted Directory (&apos;Path Traversal&apos;) (CWE-22)</title><link>https://patchfirst.co/cve/CVE-2026-48313/</link><guid isPermaLink="false">CVE-2026-48313</guid><pubDate>Tue, 30 Jun 2026 00:00:00 GMT</pubDate><description>Adobe · ColdFusion 2025. Not in CISA KEV. EPSS 3.0% (higher than 87.2% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. Priority 70.5 of 100.</description><category>public-exploit</category></item><item><title>CVE-2026-48294: Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data…</title><link>https://patchfirst.co/cve/CVE-2026-48294/</link><guid isPermaLink="false">CVE-2026-48294</guid><pubDate>Tue, 16 Jun 2026 00:00:00 GMT</pubDate><description>Adobe · Adobe Acrobat PDF Extension (Chrome). Not in CISA KEV. EPSS 1.9% (higher than 79.7% of CVEs). CVSS 7.4 HIGH. Priority 68.7 of 100.</description></item><item><title>[KEV] CVE-2009-3459: Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability</title><link>https://patchfirst.co/cve/CVE-2009-3459/</link><guid isPermaLink="false">CVE-2009-3459#kev</guid><pubDate>Wed, 20 May 2026 00:00:00 GMT</pubDate><description>Adobe · Acrobat and Reader. In CISA KEV since 2026-05-20. ENISA EUVD lists it as exploited. EPSS 86.6% (higher than 99.74% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&amp;CK: T1203 Exploitation for Client Execution; T1204.002 Malicious File. Priority 69.1 of 100.</description><category>kev</category><category>public-exploit</category><category>T1203</category><category>T1204.002</category></item><item><title>[KEV] CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability</title><link>https://patchfirst.co/cve/CVE-2020-9715/</link><guid isPermaLink="false">CVE-2020-9715#kev</guid><pubDate>Mon, 13 Apr 2026 00:00:00 GMT</pubDate><description>Adobe · Acrobat. In CISA KEV since 2026-04-13. ENISA EUVD lists it as exploited. EPSS 33.5% (higher than 98.4% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&amp;CK: T1204.002 Malicious File; T1203 Exploitation for Client Execution. Priority 73.1 of 100.</description><category>kev</category><category>public-exploit</category><category>T1204.002</category><category>T1203</category></item><item><title>[KEV] CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability</title><link>https://patchfirst.co/cve/CVE-2026-34621/</link><guid isPermaLink="false">CVE-2026-34621#kev</guid><pubDate>Mon, 13 Apr 2026 00:00:00 GMT</pubDate><description>Adobe · Acrobat and Reader. In CISA KEV since 2026-04-13. ENISA EUVD lists it as exploited. EPSS 7.2% (higher than 94.3% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&amp;CK: T1204.002 Malicious File; T1203 Exploitation for Client Execution. Priority 72.9 of 100.</description><category>kev</category><category>public-exploit</category><category>T1204.002</category><category>T1203</category></item><item><title>[KEV] CVE-2025-54236: Adobe Commerce and Magento Improper Input Validation Vulnerability</title><link>https://patchfirst.co/cve/CVE-2025-54236/</link><guid isPermaLink="false">CVE-2025-54236#kev</guid><pubDate>Fri, 24 Oct 2025 00:00:00 GMT</pubDate><description>Adobe · Commerce and Magento. In CISA KEV since 2025-10-24. ENISA EUVD lists it as exploited. EPSS 95.4% (higher than 99.87% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&amp;CK: T1190 Exploit Public-Facing Application; T1550 Use Alternate Authentication Material. Priority 69.3 of 100.</description><category>kev</category><category>public-exploit</category><category>T1190</category><category>T1550</category></item><item><title>[KEV] CVE-2025-54253: Adobe Experience Manager Forms Code Execution Vulnerability</title><link>https://patchfirst.co/cve/CVE-2025-54253/</link><guid isPermaLink="false">CVE-2025-54253#kev</guid><pubDate>Wed, 15 Oct 2025 00:00:00 GMT</pubDate><description>Adobe · Experience Manager (AEM) Forms. In CISA KEV since 2025-10-15. ENISA EUVD lists it as exploited. EPSS 88.8% (higher than 99.78% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&amp;CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 70.0 of 100.</description><category>kev</category><category>public-exploit</category><category>T1190</category><category>T1059</category></item><item><title>CVE-2025-54249: Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)</title><link>https://patchfirst.co/cve/CVE-2025-54249/</link><guid isPermaLink="false">CVE-2025-54249</guid><pubDate>Tue, 09 Sep 2025 00:00:00 GMT</pubDate><description>Adobe · Adobe Experience Manager. Not in CISA KEV. EPSS 1.9% (higher than 79.9% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. Priority 60.5 of 100.</description><category>public-exploit</category></item><item><title>CVE-2025-54251: Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)</title><link>https://patchfirst.co/cve/CVE-2025-54251/</link><guid isPermaLink="false">CVE-2025-54251</guid><pubDate>Tue, 09 Sep 2025 00:00:00 GMT</pubDate><description>Adobe · Adobe Experience Manager. Not in CISA KEV. EPSS 1.7% (higher than 77.3% of CVEs). CVSS 4.3 MEDIUM. Public exploit code exists. Priority 58.5 of 100.</description><category>public-exploit</category></item><item><title>CVE-2025-54254: Adobe Experience Manager | Improper Restriction of XML External Entity Reference (&apos;XXE&apos;) (CWE-611)</title><link>https://patchfirst.co/cve/CVE-2025-54254/</link><guid isPermaLink="false">CVE-2025-54254</guid><pubDate>Tue, 05 Aug 2025 00:00:00 GMT</pubDate><description>Adobe · Adobe Experience Manager. Not in CISA KEV. EPSS 70.1% (higher than 99.38% of CVEs). CVSS 8.6 HIGH. Priority 63.2 of 100.</description></item><item><title>CVE-2025-49533: Adobe Experience Manager (MS) | Deserialization of Untrusted Data (CWE-502)</title><link>https://patchfirst.co/cve/CVE-2025-49533/</link><guid isPermaLink="false">CVE-2025-49533</guid><pubDate>Tue, 08 Jul 2025 00:00:00 GMT</pubDate><description>Adobe · Adobe Experience Manager (MS). Not in CISA KEV. EPSS 51.7% (higher than 98.9% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 67.3 of 100.</description><category>public-exploit</category></item><item><title>CVE-2025-43566: ColdFusion | Improper Limitation of a Pathname to a Restricted Directory (&apos;Path Traversal&apos;) (CWE-22)</title><link>https://patchfirst.co/cve/CVE-2025-43566/</link><guid isPermaLink="false">CVE-2025-43566</guid><pubDate>Tue, 13 May 2025 00:00:00 GMT</pubDate><description>Adobe · ColdFusion. Not in CISA KEV. EPSS 58.2% (higher than 99.09% of CVEs). CVSS 6.8 MEDIUM. Priority 24.6 of 100.</description></item></channel></rss>