Multiple Critical CVEs Target Adobe and Microsoft Products

Four critical vulnerabilities have been disclosed affecting Adobe Commerce and Microsoft Windows systems. CVE-2026-75650 in Adobe Commerce allows arbitrary code execution without user interaction, impacting online retailers and B2B storefronts. Microsoft faces two vulnerabilities: CVE-2026-85880, a heap-based buffer overflow in Windows ALPC, and CVE-2026-81963, an improper link resolution in Windows Update Stack, both enabling local privilege escalation. Additionally, CVE-2026-86218 in N-able N-central allows pre-auth remote code execution, threatening managed service providers. All vulnerabilities are actively exploited, requiring immediate remediation. CISA has added these CVEs to its KEV catalog, emphasizing their urgency.

Key Points: • CVE-2026-75650 allows arbitrary code execution in Adobe Commerce. • CVE-2026-85880 and CVE-2026-81963 enable local privilege escalation in Microsoft Windows. • CVE-2026-86218 allows pre-auth remote code execution in N-able N-central.