Back Securityweek

Adobe Patches 140 Vulnerabilities Across 10 Products

Securityweek •Eduard Kovacs • October 13, 2026

Adobe has published 10 new security advisories to inform customers roughly 140 vulnerabilities found and patched in its products.

Adobe ColdFusion updates address 32 vulnerabilities, including critical bugs that can be exploited for code execution and privilege escalation.

A significant number of flaws have been patched by Adobe in the Content Credentials SDK. The product received fixes for 30 vulnerabilities, many described as high-severity issues that can lead to a security feature bypass. Some security holes can be exploited to cause a DoS condition.

Adobe patched 18 vulnerabilities in Photoshop, nearly all allowing arbitrary code execution.

In Substance 3D Stager, Adobe fixed 16 vulnerabilities, including many high-severity arbitrary code execution flaws.

Eleven vulnerabilities have been resolved in Adobe Commerce, including several critical issues that can be exploited without authentication to execute code or escalate privileges.

Several vulnerabilities that allow arbitrary code execution have been fixed in each of the following products: FrameMaker, Dimension, Substance 3D Sampler, Substance 3D Designer, and Bridge.

Adobe says it’s not aware of any in-the-wild exploitation. Most advisories have a priority rating of 3, which indicates Adobe does not expect to see these vulnerabilities exploited in attacks. Commerce is the only product with a priority rating of 2 (threat actors have historically targeted Commerce ).

Adobe has been using frontier AI models to hunt for flaws in its own code, which helps explain the higher volume of fixes . However, the company has still credited external researchers for many of the newly patched vulnerabilities.

While AI has helped Adobe find more vulnerabilities in its software, engineers still review, validate, and approve all AI-assisted code changes before deployment.

The rise in discoveries led Adobe to stop publishing security bulletins monthly. The company has moved to a twice-monthly schedule, on the second and fourth Tuesday of each month.

Related : Google Partially Reverses Chrome Bug Bounty Cuts

Related : Bricksforge WordPress Plugin Vulnerability Exploited in the Wild

Related : Critical SonicWall Vulnerability Exploited Days After Disclosure

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Adobe Addresses 140 Vulnerabilities in Major Software Update Adobe has released 10 security advisories detailing the patching of approximately 140 vulnerabilities across its products. Notably, Adobe ColdFusion received updates for 32 vulnerabilities, including critical flaws that could lead to code execution and privilege escalation. The Content Credentials SDK was patched for 30 vulnerabilities, many of which are high-severity and could allow security feature bypasses. Adobe Photoshop had 18 vulnerabilities fixed, primarily allowing arbitrary code execution. Other products like Substance 3D Stager and Adobe Commerce also had multiple critical vulnerabilities addressed. Adobe has not reported any in-the-wild exploitation of these vulnerabilities, and most advisories have a priority rating of 3, indicating low expected exploitation risk. The company has shifted to a twice-monthly schedule for security bulletins due to the increased volume of vulnerabilities discovered, aided by AI models in their code review process. 2 sources 46

Extracted Entities

Attack Types (3)

Code Execution Denial of Service Privilege Escalation