Adobe has released security updates to fix a fresh set of security flaws, including multiple critical-severity bugs in ColdFusion versions 2025, 2023 and 2021 that could result in arbitrary file read and code execution.
Of the 30 flaws in the product, 11 are rated Critical in severity –

CVE-2025-24446 (CVSS score: 9.1) – An improper input validation vulnerability that could result in an

The Hacker News – ​Read More

A threat actor has already exploited one of the flaws in a ransomware campaign with victims in the US and other countries.

darkreading – ​Read More

Microsoft published a blog post on Tuesday about the bug alongside its larger Patch Tuesday release, detailing how hackers exploited the vulnerability and used a strain of malware called PipeMagic before deploying ransomware on victims.

The Record from Recorded Future News – ​Read More

Neither security issue requires user interaction, and one of the vulnerabilities was used to unlock a student activist’s device in an attempt to install spyware.

darkreading – ​Read More