InfoSecBulletin Cybersecurity for mankind
On Tuesday, Adobe released security updates for 254 vulnerabilities in its software, mainly affecting Experience Manager (AEM). There are 254 flaws, 225 of which are in AEM, affecting AEM Cloud Service and earlier versions up to 6.5.22. These have been addressed in AEM Cloud Service Release 2025.5 and version 6.5.23.
“Successful exploitation of these vulnerabilities could result in arbitrary code execution, privilege escalation, and security feature bypass,” Adobe said in an advisory.
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Nearly all 225 vulnerabilities are identified as cross-site scripting (XSS), consisting of stored XSS and DOM-based XSS, enabling potential arbitrary code execution.
Adobe has acknowledged Jim Green (green-jam), Akshay Sharma (anonymous_blackzero), and lpi for discovering XSS flaws.
The key flaw resolved in this month’s update is a code execution issue in Adobe Commerce and Magento Open Source.
CVE-2025-47110, scoring 9.1, is a critical reflected XSS vulnerability that can lead to arbitrary code execution. There’s also CVE-2025-43585 with a score of 8.2, an improper authorization issue that might result in a security bypass.
The following versions are impacted:
Adobe Commerce (2.4.8, 2.4.7-p5 and earlier, 2.4.6-p10 and earlier, 2.4.5-p12 and earlier, and 2.4.4-p13 and earlier)
Adobe Commerce B2B (1.5.2 and earlier, 1.4.2-p5 and earlier, 1.3.5-p10 and earlier, 1.3.4-p12 and earlier, and 1.3.3-p13 and earlier)
Magento Open Source (2.4.8, 2.4.7-p5 and earlier, 2.4.6-p10 and earlier, 2.4.5-p12 and earlier)
The remaining updates include four that fix code execution issues in Adobe InCopy (CVE-2025-30327, CVE-2025-47107, CVSS scores: 7.8) and in Substance 3D Sampler (CVE-2025-43581, CVE-2025-43588, CVSS scores: 7.8).
None of the bugs are publicly known or exploited, but users should update to the latest version for safety.
