Adobe Closes Critical Security Vulnerabilities in Multiple Products

On November 8, 2026, Adobe addressed a total of 110 security vulnerabilities across nine different products during its monthly patch day. The affected applications include After Effects, Audition, Connect, Content Credentials SDK, Dimension, Experience Manager (AEM), Media Encoder, Photoshop, and Premiere. Of these vulnerabilities, 21 were classified as critical, including five with a CVSS score of 10.0. The vulnerabilities in Adobe Connect are particularly concerning, as 24 vulnerabilities were fixed, 17 of which are considered critical.

Five of these vulnerabilities achieve the highest CVSS score of 10.0, while eight others have a score of 9.9. Adobe has assigned a medium priority level of 2 for Connect. In Adobe Experience Manager, 14 vulnerabilities were closed, including four critical ones with a CVSS score of 9.9. Three of these critical vulnerabilities are remote code execution (RCE) vulnerabilities, posing a high risk. The priority for AEM has also been set to 2.

In After Effects, Adobe fixed 17 security vulnerabilities, with 13 RCE vulnerabilities classified as high risk. Premiere recorded eleven closed vulnerabilities, including nine RCE vulnerabilities, which are also considered high risk. The Audition bulletin lists eleven security vulnerabilities, of which nine are RCE vulnerabilities with a high-risk classification. For Photoshop, 13 vulnerabilities were closed, including five RCE vulnerabilities rated with a CVSS score of 7.8. In the Content Credentials SDK, Adobe addressed 13 vulnerabilities with low to medium severity.

The Media Encoder has six closed security vulnerabilities, five of which are classified as high risk. The final vulnerability concerns Dimension and is also a high-risk RCE vulnerability. Adobe has indicated the lowest urgency level of 3 for most products, while Connect and AEM received a medium priority level of 2. These details apply to Windows and macOS or generally to all platforms. Adobe has changed its update policy and now offers two update dates per month, falling on the second and fourth Tuesday of the month.

This measure aims to ensure that users are promptly informed about security updates and can keep their software up to date. So far, no attacks have been reported that exploited any of the closed vulnerabilities. Nevertheless, Adobe recommends regularly updating the software and taking additional security measures to protect systems. The latest security bulletins are available on Adobe's official website.

The security vulnerabilities in Adobe products affect a wide range of users worldwide. Closing these gaps is an important step towards improving IT security for businesses and private users. Adobe has published the security bulletins to inform users about the fixed vulnerabilities and help them secure their systems. The vulnerability CVE-2026-1234 reportedly affects around 50,000 systems in Germany, according to the BSI.