- SecurityWeek reports Adobe fixed roughly 140 vulnerabilities across 10 products and moved from monthly to twice-monthly security bulletins.
- Adobe says it has seen no in-the-wild exploitation, but ColdFusion and Commerce carry flaws that allow code execution.
- Leaders should confirm who owns each Adobe product, and whether patching can keep pace with a bulletin every two weeks.
The patch calendar just got faster
Adobe has changed how often it tells customers about security fixes. SecurityWeek reports that the bulletins no longer come monthly. They now come twice a month, on the second and fourth Tuesday.
The reason is volume. Adobe just published 10 advisories covering roughly 140 flaws. SecurityWeek says part of the explanation is that Adobe has pointed advanced AI models at its own software to look for weaknesses.
AI is not the whole story. Adobe also credited outside researchers for many of the fixes.
This is one vendor's choice, so it does not prove an industry trend. The lesson here is our own interpretation, not a finding in the report. If AI makes bugs easier to find, the vendor does the finding and the customer does the patching. SecurityWeek gives no cost figures, so "easier" is an inference.
Where the fixes land
The fixes are not spread evenly. ColdFusion got fixes for 32 flaws. Some are critical and allow code execution and privilege escalation.
The Content Credentials SDK got 30 fixes. Many are high severity and can lead to a security feature bypass. Photoshop got 18 fixes, and nearly all of those flaws allow arbitrary code execution. Substance 3D Stager got 16, many of them high-severity code-execution bugs.
Adobe Commerce got 11 fixes. SecurityWeek says several are critical. An attacker could use them to run code or gain higher privileges without logging in.
Adobe also closed code-execution holes in FrameMaker, Dimension and Bridge. The same goes for two Substance 3D tools, Sampler and Designer.
Flaw types, and how more discoveries become more bulletins
Arbitrary code execution means an attacker can run their own commands on the affected system. Privilege escalation means a limited user gains more power than intended.
A security feature bypass means a protection can be skipped. A DoS, short for denial of service, means the product can be knocked offline.
The phrase "without authentication" matters most for Commerce. It means no login is needed to trigger the flaw. A storefront team should read that advisory first.
Here is how discovery feeds the calendar. Every flaw found, whether by Adobe's AI-assisted searches or by outside researchers, needs a fix. Every fix must be listed in an advisory. SecurityWeek says the rise in discoveries is what led Adobe to drop monthly bulletins. More findings per month made bigger bulletins, and the schedule changed.
Adobe's own risk signal
Adobe says it knows of no attacks using these flaws in the wild. Most advisories carry a priority rating of 3. SecurityWeek says that means Adobe does not expect attacks on them.
Commerce is the only product rated 2. SecurityWeek notes that threat actors have targeted Commerce before.
The rating helps sort the work. But it is the vendor's estimate. It does not tell you what attackers will do next.
The idea: more discovery makes patching a standing job
Many teams treat patching as a monthly errand. A bulletin every two weeks turns it into a standing job.
Some people will feel this more than others. Administrators who keep ColdFusion servers running will feel it. So will the team behind a Commerce store, and the designers whose desktop tools need updates.
SecurityWeek adds that Adobe engineers still review, validate and approve every AI-assisted code change before it ships. Human review sits on the vendor side. Customers need the same discipline when they deploy.
Questions to put to your team
First, which Adobe products do we run, and who owns each one? Server products such as ColdFusion and Commerce need a named owner. Desktop tools such as Photoshop and Bridge need a way to push updates.
Second, can we apply a fix within days of a bulletin, twice a month? If the process was built for a monthly cycle, test whether it can cope with the new pace.
Third, who reads each bulletin on release day? Start with the Commerce advisory and the code-execution fixes in ColdFusion. Then work down by Adobe's priority rating.
A vendor that finds more of its own flaws is doing its job. The test for customers is whether their patching can keep up.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: SecurityWeek.
