DaystoPatch

VendorsEnterprise apps

Adobe

Adobe makes creative and document software (Acrobat and Reader, Photoshop, Illustrator), ColdFusion, and the Adobe Experience Manager and Commerce (Magento) platforms.

Response trend, 6 months
Not enough history
Open now
None
Latest incident
7 Sep 2026
Incidents on record
10 (9 not yet reviewed)

Response to exploited bugs

Not rated. No reviewed zero-days yet.

Fixing privately reported bugs

77 range 71–82rank 3 of 20

Medium confidence, 56 private reports

What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work

Embed this report card

Why these grades

Every clock starts at the first public report.

  • Response to exploited bugs: not rated. No reviewed exploited zero-days in the last 36 months, so this grade does not apply yet.
  • Fixing privately reported bugs: B (76). Median 88 days from private report to ZDI's public advisory (56 cases). 11 of 56 took longer than ZDI's 120-day deadline.
  • 1 of 1 reviewed exploited bug had a public fix before exploitation was reported. It does not count toward the response grade. For one of them, fixes for every version came later, up to 7 days. 6 more exploited incidents await researcher review and are not graded.

Response to exploited bugs: sub-scores

  • Time to first advisoryNo reviewed zero-days in the last 36 months
    NR
    0 cases, not used
  • Time to first fixNo reviewed zero-days in the last 36 months
    NR
    0 cases, not used
  • Time to fix all versionsNo reviewed zero-days in the last 36 months
    NR
    0 cases, not used
  • OpennessNo machine-readable advisory feed listed
    42
    4 cases, low confidence, not used for this vendor

Fixing privately reported bugs: sub-score

  • Private fix speedMedian 88 days from private report to ZDI's public advisory (56 cases)
    77B
    56 cases, medium confidence, weight 100%

Response fingerprint

Compressed time scale

Counts toward the response grade 0

No incidents count toward the grade yet.

Not graded 10: n-days, unreviewed timelines and end-of-life products
  1. 7 Sep 2026Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityNot graded: unreviewed
  2. 11 Aug 2026Adobe Commerce and Magento Incorrect Authorization Vulnerability Not graded: unreviewed
  3. 30 Jun 2026Adobe ColdFusion Path Traversal VulnerabilityNot graded: unreviewed
  4. 11 Apr 2026Adobe Acrobat and Reader Prototype Pollution VulnerabilityNot graded: unreviewed
  5. 9 Sep 2025Adobe Commerce and Magento Improper Input Validation VulnerabilityNot graded: unreviewed
  6. 29 Jul 2025Adobe Experience Manager Forms on JEE pre-auth RCE disclosed with PoC before Adobe's out-of-band fix (CVE-2025-54253)Not graded: n-day
  7. 18 Mar 2024Adobe ColdFusion Improper Access Control VulnerabilityNot graded: unreviewed
  8. 19 Aug 2020Adobe Acrobat Use-After-Free VulnerabilityNot graded: unreviewed
  9. 27 Apr 2017Adobe ColdFusion Deserialization VulnerabilityNot graded: unreviewed
  10. 13 Oct 2009Adobe Acrobat and Reader Heap-Based Buffer Overflow VulnerabilityNot graded: unreviewed
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Open, no fix
  • Open, partly fixed
  • Fixed when disclosed
  • Date only, no time of day

One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.

Exploited incidents

10 in 24 months, 0 with known ransomware use, 0% exploited before a fix

First reportIncidentCVSSSilenceFirst fixAll fixedStatusGrade
7 Sep 2026Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityCVE-2026-7565010.0–not datednot datedUnknownNot graded: unreviewed
11 Aug 2026Adobe Commerce and Magento Incorrect Authorization Vulnerability CVE-2026-713629.1–not datednot datedUnknownNot graded: unreviewed
30 Jun 2026Adobe ColdFusion Path Traversal VulnerabilityCVE-2026-4828210.0–not datednot datedUnknownNot graded: unreviewed
11 Apr 2026Adobe Acrobat and Reader Prototype Pollution VulnerabilityCVE-2026-346218.6–not datednot datedUnknownNot graded: unreviewed
9 Sep 2025Adobe Commerce and Magento Improper Input Validation VulnerabilityCVE-2025-542369.1–not datednot datedUnknownNot graded: unreviewed
29 Jul 2025Adobe Experience Manager Forms on JEE pre-auth RCE disclosed with PoC before Adobe's out-of-band fix (CVE-2025-54253)CVE-2025-54253, CVE-2025-5425410.07d7d7dFixedNot graded: n-day
18 Mar 2024Adobe ColdFusion Improper Access Control VulnerabilityCVE-2024-207677.4–not datednot datedUnknownNot graded: unreviewed
19 Aug 2020Adobe Acrobat Use-After-Free VulnerabilityCVE-2020-97157.8–not datednot datedUnknownNot graded: unreviewed
27 Apr 2017Adobe ColdFusion Deserialization VulnerabilityCVE-2017-30669.8–not datednot datedUnknownNot graded: unreviewed
13 Oct 2009Adobe Acrobat and Reader Heap-Based Buffer Overflow VulnerabilityCVE-2009-34598.8–not datednot datedUnknownNot graded: unreviewed

Private reports

Median 89 days, 20% over 120 days, 0 published unpatched

Bugs reported privately to Adobe by ZDI or Project Zero.

One tick per graded report. Counts to the vendor's fix when its date is known, else to publication. Taller ticks were published before a fix existed.
PublishedAdvisoryProductDays from report to fix or to publication. Tick: ZDI's 120-day deadline.Patch at publication
15 Oct 2026ZDI-26-778CVE-2026-95636Photoshop69to publicationYes
15 Oct 2026ZDI-26-777CVE-2026-83661Photoshop148to publicationYes
10 Sep 2026ZDI-26-665CVE-2026-79909Acrobat Reader DC40to publicationYes
10 Sep 2026ZDI-26-666CVE-2026-79910Acrobat Reader DC43to publicationYes
10 Sep 2026ZDI-26-659, ZDI-26-660, ZDI-26-671, ZDI-26-676CVE-2026-80160, CVE-2026-80161, CVE-2026-80162, CVE-2026-81973Acrobat Reader DC50to publicationYes
10 Sep 2026ZDI-26-667, ZDI-26-669, ZDI-26-672, ZDI-26-675CVE-2026-81975, CVE-2026-81976, CVE-2026-81977, CVE-2026-81978Acrobat Reader DC72to publicationYes
10 Sep 2026ZDI-26-677, ZDI-26-679CVE-2026-75771, CVE-2026-75862Photoshop76to publicationYes
10 Sep 2026ZDI-26-674CVE-2026-81981Acrobat Reader DC84to publicationYes
10 Sep 2026ZDI-26-678CVE-2026-75863Photoshop87to publicationYes
10 Sep 2026ZDI-26-658, ZDI-26-661, ZDI-26-664, ZDI-26-668CVE-2026-81984, CVE-2026-81985, CVE-2026-81986, CVE-2026-81987Acrobat Pro DC; Acrobat Reader DC92to publicationYes
Show all 56 private reports
PublishedAdvisoryProductDays from report to fix or to publication. Tick: ZDI's 120-day deadline.Patch at publication
10 Sep 2026ZDI-26-662, ZDI-26-663, ZDI-26-670, ZDI-26-673CVE-2026-81988, CVE-2026-81989, CVE-2026-81990, CVE-2026-81991Acrobat Reader DC; Acrobat Pro DC100to publicationYes
15 Jul 2026ZDI-26-262, ZDI-26-420CVE-2026-34619, CVE-2026-48344ColdFusion; Creative Cloud112to publicationYes
15 Jul 2026ZDI-26-419CVE-2026-48272Creative Cloud124to publicationYes
24 Jun 2026ZDI-26-361CVE-2026-27278Acrobat Reader DC120to publicationYes
10 Jun 2026ZDI-26-355CVE-2026-27220Acrobat Reader DC127to publicationYes
9 Jun 2026ZDI-26-352, ZDI-26-353, ZDI-26-354CVE-2026-47917, CVE-2026-47918, CVE-2026-47919Acrobat Pro DC; Acrobat Reader DC40to publicationYes
9 Jun 2026ZDI-26-351CVE-2026-48292USD-Fileformat-plugins61to publicationYes
9 Jun 2026ZDI-26-349CVE-2026-47915Acrobat Pro DC68to publicationYes
9 Jun 2026ZDI-26-350CVE-2026-48291USD-Fileformat-plugins69to publicationYes
9 Jun 2026ZDI-26-343, ZDI-26-344, ZDI-26-345, ZDI-26-346, ZDI-26-347, ZDI-26-348CVE-2026-47911, CVE-2026-47912, CVE-2026-47913, CVE-2026-47914, CVE-2026-47923, CVE-2026-47924Acrobat Reader DC71to publicationYes
15 Apr 2026ZDI-26-263CVE-2026-27282ColdFusion20to publicationYes
15 Apr 2026ZDI-26-264CVE-2026-27305ColdFusion26to publicationYes
6 Feb 2026ZDI-26-070CVE-2025-61808ColdFusion169to publicationYes
9 Dec 2025ZDI-25-1043CVE-2025-64899Acrobat Reader DC166to publicationYes
13 Nov 2025ZDI-25-993, ZDI-25-994, ZDI-25-995, ZDI-25-996, ZDI-25-997, ZDI-25-998, ZDI-25-999, ZDI-25-1000CVE-2025-61838, CVE-2025-61839, CVE-2025-61840, CVE-2025-61841, CVE-2025-61842, CVE-2025-61843, CVE-2025-61844, CVE-2025-61845USD-Fileformat-plugins70to publicationYes
13 Nov 2025ZDI-25-992CVE-2025-61837USD-Fileformat-plugins77to publicationYes
10 Jun 2025ZDI-25-337CVE-2025-47112Acrobat Reader DC41to publicationYes
10 Jun 2025ZDI-25-335CVE-2025-43575Acrobat Reader DC91to publicationYes
10 Jun 2025ZDI-25-336, ZDI-25-338CVE-2025-43573, CVE-2025-43574Acrobat Reader DC97to publicationYes
21 May 2025ZDI-25-308CVE-2025-30310Dreamweaver161to publicationYes
30 Apr 2025ZDI-25-258, ZDI-25-259CVE-2024-34098, CVE-2024-34099Acrobat Reader DC371to publicationYes
18 Mar 2025ZDI-25-131, ZDI-25-132, ZDI-25-135, ZDI-25-149CVE-2025-27159, CVE-2025-27160, CVE-2025-27162, CVE-2025-271561Acrobat Reader DC39to publicationYes
13 Mar 2025ZDI-25-133CVE-2025-27174Acrobat Reader DC23to publicationYes
13 Mar 2025ZDI-25-134CVE-2025-24431Acrobat Reader DC98to publicationYes
20 Jan 2025ZDI-25-046CVE-2025-21127Photoshop109to publicationYes
21 Nov 2024ZDI-24-1130, ZDI-24-1138, ZDI-24-1605CVE-2024-39426, CVE-2024-41840, CVE-2024-49529Acrobat Reader DC; Bridge; InDesign153to publicationYes
8 Oct 2024ZDI-24-599, ZDI-24-1137, ZDI-24-1139, ZDI-24-1142, ZDI-24-1143, ZDI-24-1144, ZDI-24-1197, ZDI-24-1198, ZDI-24-1199, ZDI-24-1200, ZDI-24-1201, ZDI-24-1202, ZDI-24-1331, ZDI-24-1332CVE-2024-20789, CVE-2024-34115, CVE-2024-34124, CVE-2024-39377, CVE-2024-39378, CVE-2024-39381, CVE-2024-39382, CVE-2024-39384, CVE-2024-39385, CVE-2024-39386, CVE-2024-39387, CVE-2024-39388, CVE-2024-45138, CVE-2024-45146Substance 3D Stager; Bridge; Dimension; Audition; Premiere Pro; After Effects; Media Encoder160to publicationYes
10 Sep 2024ZDI-24-1196, ZDI-24-1203CVE-2024-43760, CVE-2024-45107Acrobat Reader DC; Photoshop103to publicationYes
13 Aug 2024ZDI-24-1133CVE-2024-41831Acrobat Reader DC46to publicationYes
13 Aug 2024ZDI-24-1131, ZDI-24-1132CVE-2024-41833, CVE-2024-41834Acrobat Reader DC68to publicationYes
13 Aug 2024ZDI-24-1134CVE-2024-39424Acrobat Reader DC69to publicationYes
13 Aug 2024ZDI-24-1136CVE-2024-39423Acrobat Reader DC90to publicationYes
13 Aug 2024ZDI-24-1135CVE-2024-39422Acrobat Reader DC97to publicationYes
13 Aug 2024ZDI-24-1140, ZDI-24-1141CVE-2024-34125, CVE-2024-34126Dimension110to publicationYes
22 May 2024ZDI-24-492, ZDI-24-493CVE-2024-30279, CVE-2024-30280Acrobat Pro DC; Acrobat Reader DC140to publicationYes
19 May 2024ZDI-24-478, ZDI-24-480, ZDI-24-481, ZDI-24-482CVE-2024-34094, CVE-2024-34095, CVE-2024-34096, CVE-2024-34097Acrobat Reader DC68to publicationYes
19 May 2024ZDI-24-477CVE-2024-34101Acrobat Reader DC72to publicationYes
19 May 2024ZDI-24-479CVE-2024-30284Acrobat Reader DC73to publicationYes
19 May 2024ZDI-24-483CVE-2024-30310Acrobat Reader DC110to publicationYes
7 May 2024ZDI-24-423CVE-2024-30301Acrobat Reader DC107to publicationYes
7 May 2024ZDI-24-422, ZDI-24-424, ZDI-24-425, ZDI-24-426, ZDI-24-427CVE-2024-30302, CVE-2024-30303, CVE-2024-30304, CVE-2024-30305, CVE-2024-30306Acrobat Reader DC111to publicationYes
26 Apr 2024ZDI-24-406CVE-2023-48633After Effects219to publicationYes
13 Mar 2024ZDI-24-168, ZDI-24-284, ZDI-24-292CVE-2024-20728, CVE-2024-20745, CVE-2024-20765Acrobat Pro DC; Acrobat Reader DC; Premiere Pro98to publicationYes
13 Mar 2024ZDI-24-169, ZDI-24-291CVE-2024-20739, CVE-2024-20752Audition; Bridge106to publicationYes
13 Feb 2024ZDI-24-166CVE-2024-20736Acrobat Pro DC55to publicationYes
13 Feb 2024ZDI-24-167CVE-2024-20734Acrobat Pro DC64to publicationYes

Grade history

Response to exploited bugs: score at the end of each month.

Not rated at any point in this period.

Channels

Get Adobe's own alerts

What we watch

  • Advisory pageAdobe Trust Center: security bulletins and advisories

See sources and health for when each was last read.