Adobe's October Update Covers 176 Flaws Across 11 Products
Adobe shipped 11 security advisories on October 13, 2026, addressing roughly 176 vulnerabilities spanning its product line, from enterprise content platforms to creative tools. Adobe attributes part of the unusually high count to using frontier AI models to hunt for flaws in its own code, surfacing issues that traditional review missed.
Adobe reports no known in-the-wild exploitation of any of the vulnerabilities fixed this month.
Breakdown by Product
| Product | Vulnerabilities | Notes |
|---|---|---|
| Adobe Experience Manager (AEM) | 36 | Includes critical code execution and privilege escalation flaws |
| ColdFusion | 32 | Critical code execution and privilege escalation issues |
| Content Credentials SDK | 30 | Mostly high-severity security bypasses and denial-of-service conditions |
| Photoshop | 18 | Nearly all enable arbitrary code execution |
| Substance 3D Stager | 16 | Includes high-severity code execution flaws |
| Adobe Commerce | 11 | Critical unauthenticated code execution and privilege escalation |
| FrameMaker, Dimension, Substance 3D Sampler, Substance 3D Designer, Bridge | Remaining | Multiple arbitrary code execution vulnerabilities each |
Priority Ratings
Most of this month's advisories carry a Priority 3 rating, reflecting Adobe's assessment of low exploitation likelihood. Only Adobe Commerce and AEM were rated Priority 2, which Adobe attributes to threat actors having historically targeted Commerce deployments — a pattern seen repeatedly in prior Magento/Commerce campaigns throughout 2026.
Why It Matters
Adobe Commerce has been a recurring target this year, with multiple zero-days and actively exploited flaws disclosed against Magento/Commerce storefronts in previous months. The Priority 2 rating on Commerce and AEM in this release signals that, even without confirmed active exploitation yet, these are the products defenders should patch first — not the long tail of lower-priority creative-tool fixes.
The disclosure also highlights a broader industry trend: vendors increasingly using AI-assisted code review to find vulnerabilities before attackers do, which can produce sharp month-over-month spikes in disclosed flaw counts without necessarily indicating the software got less secure.
Recommendations
- Patch Adobe Commerce and AEM first given their Priority 2 rating and Commerce's history as an active target.
- Prioritize ColdFusion and Content Credentials SDK next given the volume and severity of fixes.
- Apply creative-tool updates (Photoshop, Substance 3D line, FrameMaker, Dimension, Bridge) on normal patch cycles since none are currently known to be exploited.
- Track CISA KEV and vendor advisories over the coming weeks — Priority 3 ratings can change quickly if proof-of-concept exploits surface for any of the 176 fixes.