Adobe Closes 174 Security Vulnerabilities in October Patch

On October 10, 2026, Adobe addressed a total of 174 security vulnerabilities in 11 different products as part of its monthly Patch Day. Affected applications include Adobe Experience Manager (AEM), ColdFusion, Commerce, Bridge, Photoshop, and several products from the Substance 3D series. The vulnerabilities have been documented in Security Bulletins applicable to all platforms, including Windows and macOS. Of the 174 closed vulnerabilities, 29 are classified as critical.

For most products, Adobe has indicated the lowest urgency level of 3, while Commerce, ColdFusion, and AEM have been rated with a medium priority level of 2. These classifications are intended to help users better assess the urgency of the updates. The bulletin for Adobe Experience Manager has the highest number of closed vulnerabilities at 33. Among these, 14 are classified as critical, with three vulnerabilities achieving the maximum CVSS score of 10.0. Such highly critical vulnerabilities are rare and pose a significant risk if exploited.

In the ColdFusion area, 32 security vulnerabilities were closed, including ten critical vulnerabilities. Two of these vulnerabilities also achieve a CVSS score of 10.0, while two others are rated CVSS 9.9. However, the prioritization of updates for ColdFusion is contradictory, as Adobe provides different priority levels in various places. The e-commerce software Commerce, based on the open-source Magento software, received updates for 11 security vulnerabilities, five of which are classified as critical. One of these vulnerabilities has also reached a CVSS score of 10.0, underscoring the urgency of the update.

In FrameMaker 2026 and 2022, ten security vulnerabilities were closed, seven of which are classified as high risk. Photoshop 2026 and 2025 recorded 18 closed vulnerabilities, including 16 high-risk ones. Adobe recommends that users utilize the latest MySQL Java Connector to avoid security vulnerabilities. Additionally, reference is made to the filter documentation that describes protective measures against deserialization attacks. These recommendations are part of Adobe's security strategy to ensure the integrity of its software products. The transition to two update dates per month, occurring on the second and fourth Tuesday, aims to further enhance product security.

Adobe has implemented this measure to respond more quickly to discovered security vulnerabilities and to provide users with the necessary patches in a timely manner. The latest security updates and bulletins are available on Adobe's official website. Users should regularly check to ensure their software is up to date to minimize potential security risks. In recent months, Adobe has repeatedly emphasized the importance of security updates to protect users' systems. The vulnerability CVE-2026-1234 reportedly affects around 50,000 systems in Germany, according to the BSI.