Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2022-20701 | 10.0 | 9.8% | ✅ listed | — | 89.6 (Critical) |
The 'bug apocalypse' is here: 88+ CVEs across Adobe and Microsoft
Trend Micro’s Zero Day Initiative has released its July 2026 Security Update Review, a single drop containing 88 unique CVEs across Adobe and Microsoft products. The release is the largest ZDI batch of the year: 63 vulnerabilities are rated Critical, six are Moderate, one is Low, and the remainder are Important.
Eight of the bugs were submitted through the ZDI program itself. Two of those are already under active exploitation, and one is publicly known. The full set spans Adobe After Effects, Animate, Audition, Bridge, ColdFusion, Commerce, Content Credentials SDK, Creative Cloud Desktop Application, Experience Manager, Illustrator, Media Encoder, and Premiere Pro, alongside the Microsoft components.
Adobe's 12-product sweep: ColdFusion, Commerce, and the rest
Adobe is patching 12 products in this drop: After Effects, Animate, Audition, Bridge, ColdFusion, Commerce, Content Credentials SDK, Creative Cloud Desktop Application, Experience Manager, Illustrator, Media Encoder, and Premiere Pro. Nine CVEs are listed across the set: CVE-2026-50518, 50522, 55008, 55010, 56155, 56164, 56188, 56190, and 58644.
ColdFusion and Commerce are the high-impact targets here. The rest round out the Creative suite, which is where most of the volume sits. If you run ColdFusion or Commerce in production, this is the one to patch first.
Two CVEs under active exploit, one public
Two of the 88+ CVEs are listed as under active exploitation in the wild, meaning ZDI is seeing real traffic rather than a lab proof-of-concept. One additional CVE is publicly known — likely the one that triggered the rush. The full set spans Adobe After Effects, Animate, Audition, Bridge, ColdFusion, Commerce, Content Credentials SDK, Creative Cloud Desktop Application, Experience Manager, Illustrator, Media Encoder, and Premiere Pro, alongside the Microsoft components.
Key points
- 88+ unique CVEs across Adobe ColdFusion, Adobe Commerce, and Microsoft
- 63 rated Critical, 6 Moderate, 1 Low, rest Important
- 8 bugs submitted through ZDI program
- 2 CVEs under active exploit, 1 publicly known
- CVE-2022-20701: CVSS 10.0, EPSS 9.8% (95th pct), KEV listed, PRS 89.6 Critical
Further reading & sources
- Zero Day Initiative — The July 2026 Security Update Review — Zero Day Initiative
- IE Memory Attacks Net ZDI $125,000 Microsoft Bounty | Threatpost
- New Windows zero-day exploited by 11 state hacking groups since 2017
- APT Groups Abuse Microsoft Windows Shortcut Exploit
- GlassWorm Malware Targets Developer IDEs Again - Checkmarx Zero
- ZDI-22-412 - TrendAI™ Zero Day Initiative™ (ZDI)
- Zero Day Initiative — Node.js Trust Falls: Dangerous Module Resolution on Windows
- Zero Day Initiative — Pwn2Own Ireland 2026 – New Targets and Categories