Adobe Deploys Critical Patch Addressing 254 Vulnerabilities to Mitigate High-Severity Security Risks

Adobe has released significant security updates addressing a total of 254 vulnerabilities that affect its software portfolio, predominantly impacting Adobe Experience Manager (AEM). Out of these, 225 vulnerabilities are related to AEM, affecting AEM Cloud Service (CS) and all versions up to and including 6.5.22. These issues have been rectified in the AEM Cloud Service Release 2025.5 and version 6.5.23.

The exploitation of these vulnerabilities could lead to serious security concerns, including arbitrary code execution, privilege escalation, and security feature bypass, as noted in an advisory from Adobe. Almost all of the 225 vulnerabilities are classified as cross-site scripting (XSS), a combination of stored and DOM-based XSS, which could be leveraged to achieve arbitrary code execution.

The discovery and reporting of these XSS vulnerabilities have been credited to security researchers such as Jim Green (green-jam), Akshay Sharma (anonymous_blackzero), and lpi. Among the critical flaws addressed in this update is a code execution vulnerability in Adobe Commerce and Magento Open Source.

One of the most severe vulnerabilities patched this month is a reflected XSS flaw designated as CVE-2025-47110, with a CVSS score of 9.1, which could result in arbitrary code execution. Additionally, an improper authorization flaw (CVE-2025-43585, CVSS score: 8.2) has been addressed, which could allow attackers to bypass security features.

The following versions of the software are affected:

– Adobe Commerce (2.4.8, 2.4.7-p5 and earlier, 2.4.6-p10 and earlier, 2.4.5-p12 and earlier, and 2.4.4-p13 and earlier)
– Adobe Commerce B2B (1.5.2 and earlier, 1.4.2-p5 and earlier, 1.3.5-p10 and earlier, 1.3.4-p12 and earlier, and 1.3.3-p13 and earlier)
– Magento Open Source (2.4.8, 2.4.7-p5 and earlier, 2.4.6-p10 and earlier, 2.4.5-p12 and earlier)

The remaining updates include four relating to code execution flaws found in Adobe InCopy (CVE-2025-30327, CVE-2025-47107, CVSS scores: 7.8) and Substance 3D Sampler (CVE-2025-43581, CVE-2025-43588, CVSS scores: 7.8).

Although none of the vulnerabilities have been reported as publicly known or exploited in the wild, it is strongly recommended that users upgrade to the latest versions to protect against potential risks.