Adobe has patched 11 CVEs in Substance 3D Stager 3.1.8 and earlier, each rated 7.8 by Adobe. All can lead to arbitrary code execution when a user opens a malicious file.
Most flaws enable arbitrary code execution.
Successful exploitation grants code execution in the context of the current user.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
Two critical issues strike Adobe Commerce and related products, including one with a top CVSS rating of 10 that permits code execution without user action.
Adobe disclosed CVE-2026-106634, a path traversal flaw in Experience Manager 6.5 LTS SP3 and earlier and 6.5.25 and earlier that lets low-privileged attackers write files to unauthorized locations. Adobe rates it 7.7 under CVSS 3.1.
Adobe ColdFusion 2025 and 2023 have a critical path traversal flaw, CVE-2026-90530, rated 9.3 by Adobe, that allows arbitrary file reads through RDS. Fixed in 2025.0.14 and 2023.0.26 per the CVE record; Production Secure Profile disables RDS.
Microsoft has published details on four critical vulnerabilities affecting Microsoft 365 Apps For Enterprise and related Office products. All four flaws carry CVSS scores of 9.8 and allow remote code execution over a network.
Juniper Networks disclosed more than 150 Junos OS and Evolved vulnerabilities, at least 15 rated 9.8 by Juniper. Critical issues include unauthenticated root access through J-Web and buffer overflows in routing and service daemons.
