Back Securityweek Adobe Patches 140 Vulnerabilities Across 10 Products
Adobe has published 10 new security advisories to inform customers roughly 140 vulnerabilities found and patched in its products.
Adobe ColdFusion updates address 32 vulnerabilities, including critical bugs that can be exploited for code execution and privilege escalation.
A significant number of flaws have been patched by Adobe in the Content Credentials SDK. The product received fixes for 30 vulnerabilities, many described as high-severity issues that can lead to a security feature bypass. Some security holes can be exploited to cause a DoS condition.
Adobe patched 18 vulnerabilities in Photoshop, nearly all allowing arbitrary code execution.
In Substance 3D Stager, Adobe fixed 16 vulnerabilities, including many high-severity arbitrary code execution flaws.
Eleven vulnerabilities have been resolved in Adobe Commerce, including several critical issues that can be exploited without authentication to execute code or escalate privileges.
Several vulnerabilities that allow arbitrary code execution have been fixed in each of the following products: FrameMaker, Dimension, Substance 3D Sampler, Substance 3D Designer, and Bridge.
Adobe says it’s not aware of any in-the-wild exploitation. Most advisories have a priority rating of 3, which indicates Adobe does not expect to see these vulnerabilities exploited in attacks. Commerce is the only product with a priority rating of 2 (threat actors have historically targeted Commerce ).
Adobe has been using frontier AI models to hunt for flaws in its own code, which helps explain the higher volume of fixes . However, the company has still credited external researchers for many of the newly patched vulnerabilities.
While AI has helped Adobe find more vulnerabilities in its software, engineers still review, validate, and approve all AI-assisted code changes before deployment.
The rise in discoveries led Adobe to stop publishing security bulletins monthly. The company has moved to a twice-monthly schedule, on the second and fourth Tuesday of each month.
Related : Google Partially Reverses Chrome Bug Bounty Cuts
Related : Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
Related : Critical SonicWall Vulnerability Exploited Days After Disclosure
Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges.
Google Partially Reverses Chrome Bug Bounty Cuts
Google is restructuring bug bounty rewards with a focus on complex memory safety vulnerabilities.
Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
The vulnerability tracked as CVE-2026-85097 can allow threat actors to take control of the targeted WordPress websites.
Critical SonicWall Vulnerability Exploited Days After Disclosure
CVE-2026-102255 is a pre-authenticated SSRF flaw that could allow attackers to perform unauthorized operations.
Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
The flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands.
Citrix Urges Immediate Patching of Critical NetScaler Vulnerability
The security defect, tracked as CVE-2026-107406, could lead to remote code execution or denial-of-service.
Cisco Patches a Dozen Critical Vulnerabilities
The security defects could lead to unauthorized access, information leaks, privilege escalation, DoS attacks, and remote code execution.
Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication
Threat actors have started targeting CVE-2026-21589, a critical vulnerability in Atlassian’s self-hosted Data Center products.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
