Zero Day Initiative - The March 2026 Security Update Review

"For March, Adobe released eight bulletins addressing 80 unique CVEs in Adobe Acrobat Reader, Commerce, Illustrator, Substance 3D Painter, Premier Pro, Experience Manager, Substance 3D Stager, and the Adobe DNG Software Development Kit (SDK). Two of these bugs were submitted through the TrendAI ZDI program."

"If you need to prioritize, the update for Acrobat likely has the most impact, with the patch fixing two Critical-rated and one Important bugs. The fix for Experience Manager is the largest this month with 33 CVEs addressed. However, these are simple cross-site scripting (XSS) bugs, so it's not too exciting."

"That's not the case for Substance 3D Stager, which fixes six different Critical bugs that could lead to arbitrary code execution. The patch for the Adobe DNG Software Development Kit (SDK) addresses one Critical and one Important bug. Finally, the update for Premiere Pro correct a single, Critical-rated bug that could lead to arbitrary code execution."

Adobe's March 2026 security update includes eight bulletins covering 80 unique CVEs across Acrobat Reader, Commerce, Illustrator, Substance 3D Painter, Premiere Pro, Experience Manager, Substance 3D Stager, and Adobe DNG SDK. Acrobat Reader receives priority attention with two Critical and one Important bug fixes. Experience Manager addresses the most CVEs with 33 vulnerabilities, primarily cross-site scripting issues. Commerce patches 19 CVEs including XSS and security feature bypass bugs with deployment priority 2. Substance 3D Stager fixes six Critical bugs enabling arbitrary code execution. Premiere Pro and Adobe DNG SDK each address Critical vulnerabilities. Two bugs were submitted through the TrendAI ZDI program. None are publicly known or under active attack at release.

Read at Zero Day Initiative