[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWZXTEg3hDdw5j4TY6dgL5jrdkqWddlPKbaEswlC5OZc":3,"$fCK4l34QnaXkRFy-yAsdU5kN7yq_CwrfJN_q-xqroYv0":85},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":82,"created_at":83,"updated_at":84,"published_at":42},"zdi-july-2026-88-cves-in-adobe-coldfusion-commerce-and-microsoft","ZDI July 2026: 88+ CVEs in Adobe ColdFusion, Commerce, and Microsoft","63 Critical, 6 Moderate, 1 Low — 8 bugs via ZDI, 2 actively exploited, 1 public","ZDI's July 2026 Security Update Review covers 88+ unique CVEs across Adobe ColdFusion, Adobe Commerce, and Microsoft, with 63 rated Critical and two under active exploitation.",[10,11,12,13,14],"ZDI","Adobe ColdFusion","Adobe Commerce","Microsoft","CVE-2022-20701","# ZDI July 2026: 88+ CVEs in Adobe ColdFusion, Commerce, and Microsoft\n\n*63 Critical, 6 Moderate, 1 Low — 8 bugs via ZDI, 2 actively exploited, 1 public*\n\n**Tags:** `ZDI` `Adobe ColdFusion` `Adobe Commerce` `Microsoft` `CVE-2022-20701`\n\n> ZDI's July 2026 Security Update Review covers 88+ unique CVEs across Adobe ColdFusion, Adobe Commerce, and Microsoft, with 63 rated Critical and two under active exploitation.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2022-20701 | 10.0 | 9.8% | ✅ listed | — | 89.6 (Critical) |\n\n## The 'bug apocalypse' is here: 88+ CVEs across Adobe and Microsoft\n\nTrend Micro’s Zero Day Initiative has released its July 2026 Security Update Review, a single drop containing 88 unique CVEs across Adobe and Microsoft products. The release is the largest ZDI batch of the year: 63 vulnerabilities are rated Critical, six are Moderate, one is Low, and the remainder are Important.\n\nEight of the bugs were submitted through the ZDI program itself. Two of those are already under active exploitation, and one is publicly known. The full set spans Adobe After Effects, Animate, Audition, Bridge, ColdFusion, Commerce, Content Credentials SDK, Creative Cloud Desktop Application, Experience Manager, Illustrator, Media Encoder, and Premiere Pro, alongside the Microsoft components.\n\n## Adobe's 12-product sweep: ColdFusion, Commerce, and the rest\n\nAdobe is patching 12 products in this drop: After Effects, Animate, Audition, Bridge, ColdFusion, Commerce, Content Credentials SDK, Creative Cloud Desktop Application, Experience Manager, Illustrator, Media Encoder, and Premiere Pro. Nine CVEs are listed across the set: CVE-2026-50518, 50522, 55008, 55010, 56155, 56164, 56188, 56190, and 58644.\n\nColdFusion and Commerce are the high-impact targets here. The rest round out the Creative suite, which is where most of the volume sits. If you run ColdFusion or Commerce in production, this is the one to patch first.\n\n## Two CVEs under active exploit, one public\n\nTwo of the 88+ CVEs are listed as under active exploitation in the wild, meaning ZDI is seeing real traffic rather than a lab proof-of-concept. One additional CVE is publicly known — likely the one that triggered the rush. The full set spans Adobe After Effects, Animate, Audition, Bridge, ColdFusion, Commerce, Content Credentials SDK, Creative Cloud Desktop Application, Experience Manager, Illustrator, Media Encoder, and Premiere Pro, alongside the Microsoft components.\n\n## Key points\n\n- 88+ unique CVEs across Adobe ColdFusion, Adobe Commerce, and Microsoft\n- 63 rated Critical, 6 Moderate, 1 Low, rest Important\n- 8 bugs submitted through ZDI program\n- 2 CVEs under active exploit, 1 publicly known\n- CVE-2022-20701: CVSS 10.0, EPSS 9.8% (95th pct), KEV listed, PRS 89.6 Critical\n\n## Further reading & sources\n\n- [Zero Day Initiative — The July 2026 Security Update Review](https:\u002F\u002Fwww.thezdi.com\u002Fblog\u002F2026\u002F7\u002F14\u002Fthe-july-2026-security-update-review) — Zero Day Initiative\n- [IE Memory Attacks Net ZDI $125,000 Microsoft Bounty | Threatpost](https:\u002F\u002Fthreatpost.com\u002Fie-memory-attacks-net-zdi-125000-microsoft-bounty\u002F110876\u002F)\n- [New Windows zero-day exploited by 11 state hacking groups since 2017](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-windows-zero-day-exploited-by-11-state-hacking-groups-since-2017\u002F)\n- [APT Groups Abuse Microsoft Windows Shortcut Exploit](https:\u002F\u002Fwww.darkreading.com\u002Fcyber-risk\u002Fnation-state-groups-abuse-microsoft-windows-shortcut-exploit)\n- [GlassWorm Malware Targets Developer IDEs Again - Checkmarx Zero](https:\u002F\u002Fcheckmarx.com\u002Fzero-post\u002Fglassworm-targets-developer-ides-again-hiding-staged-malware-behind-runtime-rebuilt-loaders)\n- [ZDI-22-412 - TrendAI™ Zero Day Initiative™ (ZDI)](https:\u002F\u002Fzerodayinitiative.com\u002Fadvisories\u002FZDI-22-412)\n- [Zero Day Initiative — Node.js Trust Falls: Dangerous Module Resolution on Windows](https:\u002F\u002Fwww.thezdi.com\u002Fblog\u002F2026\u002F4\u002F8\u002Fnodejs-trust-falls-dangerous-module-resolution-on-windows)\n- [Zero Day Initiative — Pwn2Own Ireland 2026 – New Targets and Categories](https:\u002F\u002Fwww.thezdi.com\u002Fblog\u002F2026\u002F7\u002F21\u002Fpwn2own-ireland-2026-new-targets-and-categories)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fzdi-july-2026-88-cves-in-adobe-coldfusion-commerce-and-microsoft.png?v=6b09bbbf4c",{"cves":18,"malware":35,"targets":38,"timeline":43,"technologies":52},[19,28],{"id":14,"kev":20,"poc":21,"url":22,"cvss":23,"epss":24,"risk_band":25,"risk_score":26,"cvss_version":27},true,false,"\u002Fvulnerabilities\u002FCVE-2022-20701",10,0.0975,"Critical",89.6,"3.1",{"id":29,"kev":21,"poc":21,"url":30,"cvss":31,"epss":32,"risk_band":33,"risk_score":34,"cvss_version":27},"CVE-2026-50518","\u002Fvulnerabilities\u002FCVE-2026-50518",9.8,0.0097,"Medium",54.21,[36],{"name":37},"GlassWorm",[39],{"name":13,"sector":40,"status":41,"geography":42},"software_vendor","confirmed",null,[44,48],{"date":45,"event":46,"description":47},"2025-03-18","Disclosure","Trend Micro ZDI report and Microsoft statement",{"date":49,"event":50,"description":51},"2026-07-21","Blog post","ZDI blog post announcing Pwn2Own Ireland 2026",[53,55,57,60,62,64,66,68,70,72,74,76,78,80],{"vendor":13,"product":54},"Windows",{"vendor":13,"product":56},"Internet Explorer",{"vendor":58,"product":59},"Adobe","Commerce",{"vendor":58,"product":61},"Audition",{"vendor":58,"product":63},"Content Credentials SDK",{"vendor":58,"product":65},"Animate",{"vendor":58,"product":67},"ColdFusion",{"vendor":58,"product":69},"After Effects",{"vendor":58,"product":71},"Bridge",{"vendor":58,"product":73},"Creative Cloud Desktop Application",{"vendor":58,"product":75},"Illustrator",{"vendor":58,"product":77},"Premiere Pro",{"vendor":58,"product":79},"Experience Manager",{"vendor":58,"product":81},"Media Encoder","vulnerability_disclosure","2026-09-09T07:08:04.01292+00:00","2026-10-16T12:28:48.443453+00:00",{"articles":86},[87,99,116,127],{"slug":88,"title":89,"summary":90,"tags":91,"hero_image_url":97,"story_type":82,"created_at":98},"trend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-","Trend Micro ZDI: Windows Shell Link zero-day exploited by 11 state-backed groups since 2017","Trend Micro's Zero-Day Initiative disclosed a new Windows Shell Link (.lnk) zero-day (ZDI-CAN-25373) exploited in the wild by 11 state-backed groups since 2017, which Microsoft declined to patch as 'not meeting the bar servicing'.",[92,93,94,10,95,96],"windows","shell-link","zero-day","Trend Micro","state-sponsored","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-.png?v=a2818b0e7b","2026-09-30T12:04:13.324344+00:00",{"slug":100,"title":101,"summary":102,"tags":103,"hero_image_url":113,"story_type":114,"created_at":115},"fortiguard-labs-flags-handala-exploiting-six-vendor-vulnerabilities-in-active-ir","FortiGuard Labs Flags Handala Exploiting Six Vendor Vulnerabilities in Active Iran Campaign","FortiGuard Labs issued an Outbreak Alert for the Handala group, an Iran-linked actor, actively exploiting critical vulnerabilities across six major vendor products in a sustained campaign.",[104,105,106,107,13,108,109,110,111,112],"Handala","FortiGuard","Iran","Outbreak Alert","Oracle","Apache","Hikvision","Atlassian","Ivanti","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortiguard-labs-flags-handala-exploiting-six-vendor-vulnerabilities-in-active-ir.png?v=6da17f1ec2","threat_actor_activity","2026-08-31T12:10:30.775227+00:00",{"slug":117,"title":118,"summary":119,"tags":120,"hero_image_url":125,"story_type":114,"created_at":126},"teampcp-drops-new-malware-into-42-microsoft-github-repositories","TeamPCP Drops New Malware into 42 Microsoft GitHub Repositories","TeamPCP leveraged a stolen GitHub account to publish malicious code into at least 42 repositories and 236 branches spanning the Azure, Azure-Samples, and Microsoft GitHub organizations, extending its ongoing supply-chain campaign against Microsoft-linked projects.",[121,122,123,13,124],"TeamPCP","supply-chain","GitHub","Azure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fteampcp-drops-new-malware-into-42-microsoft-github-repositories.png?v=b35dbe0163","2026-08-26T17:02:14.429711+00:00",{"slug":128,"title":129,"summary":130,"tags":131,"hero_image_url":138,"story_type":82,"created_at":139},"red-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-","Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password","Red Hat disclosed a critical vulnerability in Keycloak's reset-credentials flow that allows a remote unauthenticated attacker to bypass the email verification step and reset the password for any user account in any realm.",[132,133,134,135,136,137],"Keycloak","Red Hat","CVE-2026-18963","CVSS 9.1","account takeover","password reset","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fred-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-.png?v=94dc54a17a","2026-09-30T12:09:12.456253+00:00"]