Serial number:AV25-695
Date:October 23, 2025

On October 21, 2025, Atlassian published a security advisory to address vulnerabilities in the following products:

• Bamboo Data Center and Server – multiple versions
• Fisheye/Crucible – versions 4.9.0 to 4.9.2 and 4.8.14 to 4.8.16
• Jira Data Center and Server – multiple versions
• Jira Service Management Data Center and Server – multiple versions

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Security Bulletin - October 21 2025
• Atlassian Security Advisories and Bulletins

Serial number:AV25-583
Date:September 10, 2025
Updated:October 23, 2025

On September 9, 2025, Adobe published security advisories to address vulnerabilities in the following products:

• Acrobat DC – version Win – 25.001.20672, Mac – 25.001.20668 and prior
• Acrobat Reader DC – version Win – 25.001.20672, Mac – 25.001.20668 and prior
• Acrobat 2024 – version Win & Mac – 24.001.30254 and prior
• Acrobat 2020 – version Win & Mac – 20.005.30774 and prior
• Acrobat Reader 2020 – version Win & Mac – 20.005.30774 and prior
• Adobe After Effects – version 24.6.7 and prior
• Adobe After Effects – version 25.3 and prior
• Adobe Premiere Pro – version 25.3 and prior
• Adobe Premiere Pro – version 24.6.5 and prior
• Adobe Commerce – multiple versions
• Adobe Commerce B2B – multiple versions
• Magento Open Source – multiple versions
• Adobe Substance 3D Viewer – version 0.25.1 and prior
• Adobe Experience Manager (AEM) – version AEM Cloud Service (CS)
• Adobe Experience Manager (AEM) version 6.5 LTS SP1 and prior
• Adobe Experience Manager (AEM) – version 6.5.23 and prior
• Adobe Dreamweaver – version 21.5 and prior
• Adobe Substance 3D Modeler – version 1.22.2 and prior
• ColdFusion 2025 – version Update 3 and prior
• ColdFusion 2023 – version Update 15 and prior
• ColdFusion 2021 – version Update 21 and prior

Update 1

On October 22, 2025, the Cyber Centre became aware of open-source reporting that CVE-2025-54236 affecting Adobe Commerce is being actively exploited in the wild.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• SessionReaper attacks have started, 3 in 5 stores still vulnerable
• Adobe Commerce | APSB25-88
• Adobe ColdFusion | APSB25-93
• Adobe Security Advisories

Serial number:AV25-694
Date:October 22, 2025

On October 22, 2025, Drupal published security advisories to address vulnerabilities in the following products:

• CivicTheme Design System – version prior to 1.12.0

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates or perform the suggested mitigations.

• CivicTheme Design System - Moderately critical - Information disclosure - SA-CONTRIB-2025-112
• CivicTheme Design System - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-113
• Drupal Security Advisories

Serial number:AV25-693
Date:October 22, 2025

On October 22, 2025, ISC published security advisories to address vulnerabilities in the following product:

• ISC BIND 9 – versions 9.11.3-S1 to 9.16.50-S1
• ISC BIND 9 – versions 9.18.11-S1 to 9.18.39-S1
• ISC BIND 9 – versions 9.20.9-S1 to 9.20.13-S1
• ISC BIND 9 – versions 9.11.0 to 9.16.50
• ISC BIND 9 – versions 9.18.0 to 9.18.39
• ISC BIND 9 – versions 9.20.0 to 9.20.13
• ISC BIND 9 – versions 9.21.0 to 9.21.12

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• ISC BIND security advisory - CVE-2025-8677
• ISC BIND security advisory - CVE-2025-40778
• ISC BIND security advisory - CVE-2025-40780
• BIND 9 Security Vulnerability Matrix

Serial number:AV25-692
Date:October 22, 2025

On October 21, 2025, Google published a security advisory to address a vulnerability in the following product:

• Stable Channel Chrome for Desktop – versions prior to 141.0.7390.122/.123 (Windows and Mac) and 141.0.7390.122 (Linux)

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates, when available.

• Google Chrome Security Advisory

Serial number:AV25-691
Date:October 22, 2025

Between September 25 and October 13, 2025, Ericsson published security advisories to address vulnerabilities in the following products:

• Ericsson Indoor Connect 8855 – versions prior to 2025.Q2
• Ericcson Network Manager – versions prior to 25.1 and 25.2
• RAN Compute (all BB versions) – versions prior to 24.Q1.C5
• Site Controller 6610 – versions prior to S24.Q2

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• Security Bulletin – Ericsson Indoor Connect 8855, September 2025
• Security Bulletin – Ericsson High Severity Vulnerability in EMCLI included in Ericsson RAN Compute and Site Controller, October 2025
• Security Bulletin – Ericsson Network Manager (ENM), October 2025
• Ericsson Security Advisories