Changeflow GovPing Data Privacy & Cybersecurity Adobe Product Vulnerabilities Allow Remote Code...
Urgent Guidance Added Final

Adobe Product Vulnerabilities Allow Remote Code Execution, DoS, Security Bypass

Favicon for www.cert.ssi.gouv.fr CERT-FR Security Advisories
Published
Detected
Email

Summary

CERT-FR issued advisory CERTFR-2026-AVI-0438 warning of multiple critical vulnerabilities in Adobe products. Affected products include Acrobat 2024, Acrobat DC, Acrobat Reader DC, ColdFusion 2023, and ColdFusion 2025 on Windows and macOS. The vulnerabilities allow remote code execution, remote denial of service, and security policy bypass. ANSSI references Adobe security bulletins APSB26-38 and APSB26-44.

View original document View source feed page

What changed

CERT-FR published security advisory about critical vulnerabilities in Adobe Acrobat and ColdFusion products affecting Windows and macOS systems. The vulnerabilities, tracked across 9 CVEs (CVE-2026-27282, CVE-2026-27304 through CVE-2026-27308, CVE-2026-34619, CVE-2026-34622, CVE-2026-34626), enable remote code execution, denial of service, and security policy bypass. No specific compliance deadline or penalty is stated. Organizations using affected Adobe products should immediately apply the latest security patches referenced in Adobe bulletins APSB26-38 and APSB26-44. Failure to patch could expose systems to remote attacks and data compromise.

What to do next

  1. Apply Adobe security patches from APSB26-38 for ColdFusion
  2. Apply Adobe security patches from APSB26-44 for Acrobat
  3. Update affected Adobe products to latest versions

Archived snapshot

Apr 15, 2026

GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 15 avril 2026 N° CERTFR-2026-AVI-0438 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Multiples vulnérabilités dans les produits Adobe

Gestion du document

| Référence | CERTFR-2026-AVI-0438 |
| Titre | Multiples vulnérabilités dans les produits Adobe |
| Date de la première version | 15 avril 2026 |
| Date de la dernière version | 15 avril 2026 |
| Source(s) | Bulletin de sécurité Adobe APSB26-38 du 14 avril 2026
Bulletin de sécurité Adobe APSB26-44 du 14 avril 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.

Risques

  • Atteinte à la confidentialité des données
  • Contournement de la politique de sécurité
  • Déni de service à distance
  • Exécution de code arbitraire à distance

Systèmes affectés

  • Acrobat 2024 versions antérieures à 24.001.30365 sur Windows et macOS
  • Acrobat DC versions antérieures à 26.001.21431 sur Windows et macOS
  • Acrobat Reader DC versions antérieures à 26.001.21431 sur Windows et macOS
  • ColdFusion 2023 versions antérieures à Update 19
  • ColdFusion 2025 versions antérieures à Update 7

Résumé

De multiples vulnérabilités ont été découvertes dans les produits Adobe. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Documentation

Gestion détaillée du document

  1. le 15 avril 2026 Version initiale

Related changes

Favicon for www.cert.ssi.gouv.fr Multiple Vulnerabilities in Tenable Security Center Allow Remote Code Execution
Priority review Apr 10, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple Microsoft Office Vulnerabilities Allow Remote Code Execution, Data Breach
Priority review Apr 15, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple .NET Vulnerabilities Allow DoS and Security Bypass
Urgent Apr 15, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity

Get daily alerts for CERT-FR Security Advisories

Daily digest delivered to your inbox.

Free. Unsubscribe anytime.

Source

Favicon for www.cert.ssi.gouv.fr
CERT-FR Security Advisories cert.ssi.gouv.fr/avis
Data Privacy & Cybersecurity

About this page

What is GovPing?

Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission

What's from the agency?

Source document text, dates, docket IDs, and authority are extracted directly from CERT-FR.

What's AI-generated?

The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.

Last updated

Press inquiries →

Classification

Agency
CERT-FR
Published
April 15th, 2026
Instrument
Guidance
Legal weight
Non-binding
Stage
Final
Change scope
Substantive
Document ID
CERTFR-2026-AVI-0438

Who this affects

Applies to
Technology companies Government agencies Organizations using Adobe software
Industry sector
5112 Software & Technology
Activity scope
Software vulnerability remediation Security patch management Remote code execution prevention
Geographic scope
France FR

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Software & Technology

Browse Categories

Agriculture & Food Safety 64 AI Regulation 3 Banking & Finance 292 Consumer Protection 44 Courts & Legal 361 Data Privacy & Cybersecurity 73 Defense & National Security 51 Education 19 Energy 100 Environment 86 Environmental Regulation 7 Financial Regulation 2 Government & Legislation 279 Healthcare 136 Housing 16 Immigration 8 Insurance 58 Labor & Employment 113 Legal & Judicial 2 Pharma & Drug Safety 104 Public Health 2 Securities & Markets 103 Securities Regulation 6 Tax 65 Telecom & Technology 47 Trade & Sanctions 135 Transportation 57

Get alerts for this source

We'll email you when CERT-FR Security Advisories publishes new changes.

Free. Unsubscribe anytime.

You're subscribed!