ai-security EN

Adobe Patches 176 Vulnerabilities Across 11 Products

• Source: securityweek.com • Feed: feeds.feedburner.com

Vulnerabilities

Adobe Patches 176 Vulnerabilities Across 11 Products

The flaws affect products such as Commerce, Photoshop, ColdFusion, Substance 3D, Dimension, FrameMaker and Bridge.

Adobe Patches 176 Vulnerabilities Across 11 Products illustration

By

Eduard Kovacs

|

October 13, 2026 (1:14 PM ET)

Updated: October 14, 2026 (1:00 AM ET)

Adobe vulnerabilities

Adobe has published 11 new security advisories to inform customers about roughly 176 vulnerabilities found and patched in its products.

Adobe Experience Manager ( AEM ) received patches for 36 vulnerabilities, including several critical flaws allowing arbitrary code execution. The list also includes privilege escalation and security bypass issues.

Adobe ColdFusion updates address 32 vulnerabilities, including critical bugs that can be exploited for code execution and privilege escalation.

A significant number of flaws have been patched by Adobe in the Content Credentials SDK. The product received fixes for 30 vulnerabilities, many described as high-severity issues that can lead to a security feature bypass. Some security holes can be exploited to cause a DoS condition.

Adobe patched 18 vulnerabilities in Photoshop, nearly all allowing arbitrary code execution.

In Substance 3D Stager, Adobe fixed 16 vulnerabilities, including many high-severity arbitrary code execution flaws.

Advertisement. Scroll to continue reading.

Eleven vulnerabilities have been resolved in Adobe Commerce, including several critical issues that can be exploited without authentication to execute code or escalate privileges.

Several vulnerabilities that allow arbitrary code execution have been fixed in each of the following products: FrameMaker, Dimension, Substance 3D Sampler, Substance 3D Designer, and Bridge.

Adobe says it’s not aware of any in-the-wild exploitation. Most advisories have a priority rating of 3, which indicates Adobe does not expect to see these vulnerabilities exploited in attacks. Commerce and AEM the only products with a priority rating of 2 (threat actors have historically targeted Commerce ).

Adobe has been using frontier AI models to hunt for flaws in its own code, which helps explain the higher volume of fixes . However, the company has still credited external researchers for many of the newly patched vulnerabilities.

While AI has helped Adobe find more vulnerabilities in its software, engineers still review, validate, and approve all AI-assisted code changes before deployment.

The rise in discoveries led Adobe to stop publishing security bulletins monthly. The company has moved to a twice-monthly schedule, on the second and fourth Tuesday of each month.

* Updated with information on Adobe Experience Manager patches. Headline and lede have been updated to include AEM vulnerability count

Related : Google Partially Reverses Chrome Bug Bounty Cuts

Related : Bricksforge WordPress Plugin Vulnerability Exploited in the Wild

Related : Critical SonicWall Vulnerability Exploited Days After Disclosure

Adobe Patches 176 Vulnerabilities Across 11 Products illustration

Written By

Eduard Kovacs

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

More from Eduard Kovacs

Latest News

Adobe Patches 176 Vulnerabilities Across 11 Products illustration

iRhythm Data Breach Impacts at Least 360,000 People

Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach

Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems

Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns

US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward

Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day

Adobe Patches 176 Vulnerabilities Across 11 Products

Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

## Webinar: The AI Access Risk Already in Your Google Workspace

October 19, 2026

AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.

Register

## Virtual Event: Zero Trust & Identity Strategies Summit 2026

October 14, 2026

Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction.

Register

People on the Move

Adam Zolle has joined Nike as CISO.

Jeff Hackett has been appointed CFO at internet intelligence provider Censys.

Accenture Federal Services has named Nathaniel Parker as CISO.

More People On The Move

Expert Insights

## AI Has Changed Attack Speed, Not Security Fundamentals

Adobe Patches 176 Vulnerabilities Across 11 Products illustration

As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals. (Joshua Goldfarb)

## Four Cyber Threats Harboring Big Plans for the Future

Adobe Patches 176 Vulnerabilities Across 11 Products illustration

  • AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations. (Steve Durbin)

## Begin at the End: How to Enable Agentic Remediation

Adobe Patches 176 Vulnerabilities Across 11 Products illustration

Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael)

## “We Think the Security Control Is Working” Is No Longer Good Enough

Adobe Patches 176 Vulnerabilities Across 11 Products illustration

Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar)

## This Key Will Self-Destruct: An Open Standard for Revocable API Keys

Adobe Patches 176 Vulnerabilities Across 11 Products illustration

Every leaked credential should be dead, or dying, within sixty seconds of being found. Here’s a proposal to make that the default. (Matt Honea)

SecurityWeek

Security Community

Stay Intouch

About SecurityWeek

News Tips

Got a confidential news tip? We want to hear from you.

Submit Tip

Advertising

Reach a large audience of enterprise cybersecurity professionals

Contact Us

Daily Briefing Newsletter

Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.