Adobe Fixes 175 CVEs Across 11 Products in October Patch Batch
Adobe's October 2026 security updates address 175 CVE issues, including critical flaws in ColdFusion, Experience Manager and Commerce that allow arbitrary code execution.
Adobe released its October 2026 security updates on October 13, fixing a total of 175 CVE issues across 11 products, according to forest.watch.impress.co.jp. The count excludes duplicates reported across multiple products.
Three products carry Critical severity ratings and a maximum CVSS base score of 10.0, each with patch priority 2: ColdFusion (APSB26-144) with 32 issues, Experience Manager (APSB26-152) with 36 issues, and Commerce together with Magento Open Source (APSB26-153) with 11 issues. Adobe states that the vulnerabilities in these products could lead to arbitrary code execution.
Eight further products fall under High severity with patch priority 3. The Content Credentials SDK (APSB26-163) has 30 issues at a maximum CVSS base score of 8.6, while Dimension (APSB26-171) has 7 issues at the same score. Photoshop (APSB26-158) covers 18 issues at a maximum base score of 8.2.
The remaining High-severity fixes are rated at a maximum CVSS base score of 7.8: Substance 3D Stager (APSB26-170) with 16 issues, FrameMaker (APSB26-172) with 10, Substance 3D Designer (APSB26-169) with 9, Substance 3D Sampler (APSB26-159) with 4, and Bridge (APSB26-167) with 4.
No exploitation of any of the vulnerabilities has been reported so far.
Revised severity criteria
Starting this month, Adobe changed its severity rating criteria to adopt four levels — Critical, High, Medium and Low — based on CVSS v3.1 base scores.
Quick answers
How many CVE issues did Adobe fix in its October 2026 security updates?
Adobe fixed a total of 175 CVE issues across 11 products, excluding duplicates across products.
Which Adobe products received Critical severity fixes in October 2026?
ColdFusion, Experience Manager, and Commerce/Magento Open Source were rated Critical, each with a maximum CVSS base score of 10.0 and patch priority 2.
Have any of the patched vulnerabilities been exploited?
No exploitation of any of the vulnerabilities has been reported so far.