Adobe patches around 140 vulnerabilities across 10 products

Adobe has published ten new security advisories covering roughly 140 vulnerabilities patched across its products. According to SecurityWeek, the affected applications include ColdFusion, the Content Credentials SDK, Photoshop, Substance 3D Stager, Adobe Commerce and others. Adobe says it is not aware of any exploitation in the wild.

What's happening

SecurityWeek reports that Adobe's latest batch of security updates addresses approximately 140 vulnerabilities across ten products. The breakdown it gives is:

ColdFusion: 32 vulnerabilities, including critical bugs that can be exploited for code execution and privilege escalation.
Content Credentials SDK: 30 vulnerabilities, many described as high-severity issues that can lead to a security-feature bypass; some can be exploited to cause a denial-of-service condition.
Photoshop: 18 vulnerabilities, nearly all allowing arbitrary code execution.
Substance 3D Stager: 16 vulnerabilities, including many high-severity arbitrary code execution flaws.
Adobe Commerce: 11 vulnerabilities, including several critical issues that can be exploited without authentication to execute code or escalate privileges.

Several vulnerabilities that allow arbitrary code execution have also reportedly been fixed in FrameMaker, Dimension, Substance 3D Sampler, Substance 3D Designer, and Bridge.

On severity and likelihood, SecurityWeek reports that Adobe is not aware of any in-the-wild exploitation, and that most of the advisories carry a priority rating of 3 — meaning Adobe does not expect these vulnerabilities to be exploited in attacks. Commerce is the only product with a priority rating of 2; the outlet notes threat actors have historically targeted Commerce.

SecurityWeek attributes the high volume of fixes partly to Adobe using frontier AI models to hunt for flaws in its own code, while noting that the company still credits external researchers for many of the patched issues. It says engineers still review, validate and approve all AI-assisted code changes before deployment, and that the rise in discoveries led Adobe to move from monthly bulletins to a twice-monthly schedule, published on the second and fourth Tuesday of each month.

Who's affected

Organizations and individuals running the affected Adobe products: ColdFusion, the Content Credentials SDK, Photoshop, Substance 3D Stager, Adobe Commerce (Magento), FrameMaker, Dimension, Substance 3D Sampler, Substance 3D Designer, and Bridge.
Adobe Commerce stands out. Some of its flaws are reported to be exploitable without authentication to execute code or escalate privileges, and Commerce has been targeted before — which is why it carries the higher priority rating of 2.
Most other products are a lower priority. Adobe rates most of the advisories 3, indicating it does not expect exploitation, so this is largely routine patching rather than an emergency.

What to do

Install the updates from Adobe's advisories. Check the vendor's security bulletins page for the specific versions for each product you run.
Prioritise Adobe Commerce. Given its rating of 2 and the possibility of unauthenticated code execution, patch it first if you run it.
Most fixes are lower urgency, but they are still worth applying on a normal cadence — there is no reported active exploitation to race against.
Mind the schedule. Adobe now publishes security bulletins twice a month, so check on the second and fourth Tuesday rather than waiting for a single monthly release.

Sources

SecurityWeek — reports the product-by-product breakdown, the priority ratings, the AI-assisted discovery, and Adobe's move to a twice-monthly bulletin schedule.
Adobe — the vendor's security bulletins and advisories page listing these October 2026 updates.