Summary

CVE-2026-83959

Adobe Substance 3D Sampler contains a heap-based buffer overflow vulnerability triggered by opening a malicious file. Successful exploitation allows an attacker to achieve arbitrary code execution in the context of the current user, requiring user interaction to open the crafted file.

Affected products:

• Substance 3D Sampler

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-83959

CVE-2026-75650

Adobe Commerce contains a vulnerability involving improper neutralization of special elements used in a template engine, which allows an unauthenticated attacker to execute arbitrary code. The vulnerability is categorized as remote code execution, does not require user interaction, and impacts the integrity and availability of the system.

Affected products:

• Adobe Commerce

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75650

CVE-2026-76200

Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability allowing attackers to inject malicious JavaScript into form fields. When a victim accesses the affected page, the script executes within the victim's session, potentially leading to unauthorized account access or session hijacking.

Affected products:

• Commerce

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-76200

Related in this roundup: CVE-2026-76201.

CVE-2026-76201

Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability allowing an attacker to inject malicious scripts into form fields. When a victim accesses the affected page, the script executes in their browser, potentially leading to session hijacking or unauthorized account access.

Affected products:

• Commerce

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-76201

Related in this roundup: CVE-2026-76200.

CVE-2026-82004

Adobe Campaign Classic (ACC) is vulnerable to an OS command injection flaw (CVE-2026-82004) that allows unauthenticated attackers to achieve remote code execution in the context of the current user without requiring user interaction. The vulnerability has a CVSS v3.1 base score of 10.0 and involves a changed scope, indicating potential impact beyond the affected service.

Affected products:

• Campaign Classic

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-82004

CVE-2026-19232

Adobe Experience Manager is vulnerable to an incorrect authorization flaw that allows a low-privileged attacker to achieve arbitrary code execution. The vulnerability does not require user interaction and can result in the attacker gaining elevated access or control over a victim's session, leading to a full compromise of the affected account scope.

Affected products:

• Experience Manager

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-19232

CVE-2026-48273

Adobe ColdFusion is vulnerable to an improper neutralization of directives in dynamically evaluated code (Eval Injection), which allows a low-privileged attacker to achieve remote code execution without user interaction. The vulnerability results in a change of scope, significantly increasing the impact of successful exploitation.

Affected products:

• ColdFusion

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-48273