Adobe Patch Tuesday, September 2025: the CVEs
Filter
Adobe Patch Tuesday September 2025: the CVEs Adobe published on 9 September 2025, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, SAP. Earlier: Aug 2025, Jul 2025, Jun 2025, May 2025, Apr 2025, Mar 2025, Feb 2025, Jan 2025, Dec 2024, Nov 2024, Oct 2024, Sep 2024. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday
- 10.0CVE-2025-54261EPSS 27%
ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution by an attacker. The victim…
- 9.1CVE-2025-54236KEVExploitEPSS 96%
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing …