A Big Rollup, Led by Experience Manager
Adobe's September 2026 security update round shipped fixes for more than 170 vulnerabilities spread across its product line — one of the larger Patch Tuesday batches this year. The lion's share sits in Adobe Experience Manager, which alone accounts for 107 vulnerabilities patched this cycle, followed by 32 flaws in Acrobat/Acrobat Reader, plus smaller counts in Photoshop (8), Illustrator (3), Animate (1), and Photoshop Mobile.
While the batch already includes the actively-exploited Adobe Commerce/Magento "StyleSmuggler" zero-day (CVE-2026-75650) covered separately on Labs, this cycle's real breadth is in the products that don't usually make headlines.
Two Critical RCEs in ColdFusion
Adobe ColdFusion picked up two critical remote-code-execution fixes:
| CVE | CVSS | Type |
|---|---|---|
| CVE-2026-48273 | 9.9 | Code execution |
| CVE-2026-75746 | 9.1 | Code execution |
Adobe also patched seven additional high/medium-severity ColdFusion issues in the same update.
Campaign Classic: A Perfect 10
Adobe Campaign Classic received a fix for CVE-2026-82004, an OS command injection vulnerability rated a maximum CVSS 10.0 — the top score on the scale. A flaw at that severity, paired with command injection, typically means unauthenticated network-based code execution with no meaningful mitigating factors in the vector string.
Commerce: Nine More Fixes Beyond the Zero-Day
Beyond the already-exploited StyleSmuggler bug, Adobe Commerce/Magento picked up eight additional vulnerabilities in this cycle: two critical privilege-escalation flaws and six high-severity security-bypass issues. Commerce administrators patching this cycle should treat it as a full update, not a single-CVE fix.
Remediation Guidance
Adobe's own release notes classify most of this batch as Priority 1, meaning administrators are expected to apply updates within three days of release. For Commerce specifically, Adobe is also recommending a credential rotation pass — encryption keys, database passwords, integration tokens, OAuth secrets, and API keys — at the source systems, not just inside the Commerce admin panel, given how many separate Commerce-adjacent flaws have surfaced this quarter.
Priority checklist:
- Patch Experience Manager instances first given the sheer volume of fixes (107) — prioritize any AEM instance exposed to the internet.
- Apply the ColdFusion critical RCE fixes (CVE-2026-48273, CVE-2026-75746) on any server running ColdFusion-based applications.
- Patch Campaign Classic immediately given the CVSS 10.0 OS command injection (CVE-2026-82004).
- Confirm Commerce/Magento stores are current on both the StyleSmuggler zero-day fix and this cycle's additional nine vulnerabilities, then rotate credentials.
- Roll out Acrobat/Acrobat Reader updates fleet-wide — 32 fixes is a large batch for client-side software with broad deployment.