Adobe Fixes 38 Security Vulnerabilities in Multiple Programs

On August 22, 2026, Adobe resolved a total of 38 security vulnerabilities in seven different software products as part of its second patch day in August. The affected programs include Campaign Classic, Content Credentials SDK, Illustrator, Substance 3D Designer, Substance 3D Painter, Substance 3D Sampler, and XD. Of the 38 vulnerabilities, 32 were classified as critical, indicating a high risk for users. The security updates were documented in seven security bulletins.

Adobe assigned the lowest urgency level of 3 for most of these updates, as no attacks exploiting these vulnerabilities have been reported so far. However, Campaign Classic was given the highest priority level of 1, as all three fixed vulnerabilities achieved a maximum CVSS score of 10.0. Campaign Classic had already presented two 10.0 vulnerabilities in updates in previous months, which is considered extremely rare. The resolution of three critical vulnerabilities in this software is regarded as particularly significant, as it represents a type of "triple unicorn" for which there is currently no adequate designation. For the Content Credentials SDK, Adobe provided updates for a total of six vulnerabilities, three of which are classified as critical.

These updates are relevant for versions c2pa-v0.89.0 and older, while the secured version is c2pa-v0.90.116. In Illustrator 2026 and 2025, a high-risk vulnerability with the CVE number CVE-2026-71441 was fixed. This vulnerability poses a potential risk for users utilizing these versions of the software. The only security vulnerability fixed in Adobe XD carries the CVE number CVE-2026-71399 and is also classified as critical.

The Substance 3D product family is represented by three security bulletins. In Substance 3D Designer, Adobe closed nine vulnerabilities, eight of which are considered critical. In Substance 3D Painter, seven out of eight vulnerabilities were classified as critical, while in Substance 3D Sampler, all ten vulnerabilities were classified as critical. During the first patch day on August 11, 2026, Adobe had already addressed over 50 vulnerabilities in other products such as ColdFusion and Lightroom.

These regular updates are part of Adobe's strategy to continuously improve the security of its software products and provide better protection for users. The security updates apply to all platforms, including Windows and macOS, unless otherwise specified. Adobe recommends that users always update their software to the latest versions to benefit from the security enhancements. The latest security bulletins and details on the fixed vulnerabilities are available on Adobe's official website.

Users should regularly check for the latest updates to best protect their systems. Adobe has increasingly focused on the security of its products in recent months, as reflected in the number of vulnerabilities addressed. Continuous monitoring and resolution of security gaps are crucial to ensuring user protection. The vulnerability CVE-2026-71399 affects all versions of Adobe XD released prior to the update, according to Adobe.