Adobe has released a series of critical security updates addressing vulnerabilities across multiple products, including Acrobat, Reader, Photoshop, and Experience Manager. These patches come as part of Adobe's monthly security bulletin and address flaws that could allow attackers to execute arbitrary code, escalate privileges, or bypass security features.
The Critical Vulnerabilities Patched
This month's updates address 48 vulnerabilities across Adobe's product line, with 15 rated as Critical by Adobe's security team. The most severe vulnerabilities include:
- CVE-2023-26369: A memory corruption flaw in Acrobat and Reader (CVSS score 9.8)
- CVE-2023-26370: An out-of-bounds write vulnerability in Photoshop (CVSS score 7.8)
- CVE-2023-26371: A security bypass in Experience Manager (CVSS score 8.8)
Affected Products and Versions
The security updates impact the following Adobe products:
- Adobe Acrobat and Reader: DC and 2020 versions for Windows and macOS
- Adobe Photoshop: 2023 versions for Windows and macOS
- Adobe Experience Manager: 6.5 and cloud service implementations
- Adobe Commerce: 2.4.6 and earlier
Why These Updates Matter
Security researchers have identified that several of these vulnerabilities are being actively exploited in limited attacks. The Acrobat and Reader flaws are particularly concerning as they could allow:
- Remote code execution when opening malicious PDF files
- System compromise without user interaction in some cases
- Privilege escalation on already compromised systems
Update Recommendations
Adobe strongly recommends that all users:
- Apply updates immediately through the Creative Cloud desktop app
- Enable automatic updates where available
- Verify successful installation by checking version numbers
For enterprise deployments, Adobe provides detailed deployment guides through their Enterprise Toolkit.
The Bigger Security Picture
These updates come as part of Adobe's Patch Tuesday releases, coordinated with Microsoft's monthly security updates. The company has significantly improved its vulnerability response time, with this month's patches addressing:
- 78% of reported vulnerabilities within 90 days
- 92% of critical flaws within 120 days
How to Check Your Adobe Software Version
Users can verify their current version and update status by:
- Opening any Adobe application
- Navigating to Help > About [Product Name]
- Comparing the version number to Adobe's security bulletin
Future Security Developments
Adobe has announced plans to:
- Expand its bug bounty program rewards
- Implement additional sandboxing protections in Reader
- Accelerate patch development cycles
These changes aim to reduce the window of vulnerability between flaw discovery and patch availability.
Conclusion
Staying current with Adobe security updates remains one of the most effective ways to protect against PDF-based and creative software attacks. Organizations should prioritize deploying these patches, especially for Acrobat and Reader installations which are frequent attack targets.