CVE-2026-82010

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Adobe Linux Microsoft

Products

Campaign Campaign Classic Linux Kernel and 1 more

CVE-2026-82000

Adobe Experience Manager Forms JEE | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Aem 6.5 Forms Jee Aem 6.5 Lts Forms Jee

CVE-2026-81995

Adobe Experience Manager Forms JEE | Improper Input Validation (CWE-20)

Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 9.1 Critical EPSS 1.2% KEV · Not listed

Vendors

Adobe

Products

Aem 6.5 Forms Jee Aem 6.5 Lts Forms Jee

CVE-2026-81999

Adobe Experience Manager Forms JEE | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Aem 6.5 Forms Jee Aem 6.5 Lts Forms Jee

CVE-2026-75744

Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

CVSS 3.1 · 8.1 High EPSS 1.2% KEV · Not listed

Vendors

Adobe

Products

Aem 6.5 Forms Jee Aem 6.5 Lts Forms Jee

CVE-2026-84395

Premiere Pro | Server-Side Request Forgery (SSRF) (CWE-918)

Premiere Pro is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation potentially resulting in unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Premiere

CVE-2026-76192

InDesign Desktop | NULL Pointer Dereference (CWE-476)

InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Indesign Desktop

CVE-2026-27238

InDesign Desktop | Heap-based Buffer Overflow (CWE-122)

InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Indesign Indesign Desktop Macos and 1 more

CVE-2026-84397

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager Cloud Service

CVE-2026-76000

ColdFusion | Uncontrolled Resource Consumption (CWE-400)

ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion Coldfusion 2023 Coldfusion 2025

CVE-2026-76190

ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)

ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion Coldfusion 2023 Coldfusion 2025

CVE-2026-75993

ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)

ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion Coldfusion 2023 Coldfusion 2025

CVE-2026-75998

ColdFusion | Improper Access Control (CWE-284)

ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion Coldfusion 2023 Coldfusion 2025

CVE-2026-76002

ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)

ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion Coldfusion 2023 Coldfusion 2025

CVE-2026-75746

ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion Coldfusion 2023 Coldfusion 2025

CVE-2026-75990

Illustrator | Incorrect Authorization (CWE-863)

Illustrator is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Illustrator Illustrator Desktop 2025 Illustrator Desktop 2026

CVE-2026-75991

Illustrator | Improper Input Validation (CWE-20)

Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Illustrator Illustrator Desktop 2025 Illustrator Desktop 2026

CVE-2026-75992

Illustrator | Out-of-bounds Write (CWE-787)

Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Illustrator Illustrator Desktop 2025 Illustrator Desktop 2026

CVE-2026-75999

ColdFusion | Improper Input Validation (CWE-20)

ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion Coldfusion 2023 Coldfusion 2025

CVE-2026-80159

Acrobat Reader | Untrusted Search Path (CWE-426)

Acrobat Reader is affected by an Untrusted Search Path vulnerability that could result in privilege escalation. An attacker with high privileges could leverage this vulnerability to gain elevated access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat 2024 Acrobat Dc and 3 more