Adobe's October bulletins list 177 flaws; every one rated critical sits in AEM, ColdFusion or Commerce

SecurityWeek says 176, Adobe's pages list 177 entries and 175 distinct ids, and none of those counts is the risk

SecurityWeek's report on Adobe's 13 October 2026 bulletins carries two headlines. Its address still reads "140 vulnerabilities across 10 products". Its headline now reads 176 across 11. The change is SecurityWeek's own correction: the piece was updated on 14 October "with information on Adobe Experience Manager patches", and Adobe Experience Manager (AEM) has 36 entries. 140 plus 36 is 176 (derived). The number moved by 36, or 25.7 per cent of 140 (derived), in a little over 11 hours (derived from the page's own timestamps, 17:14 UTC on 13 October to 04:20 UTC on 14 October), because one bulletin was missing from the first tally.

This briefing counted from Adobe's own pages, not from the report. The Adobe Trust Center index lists 11 bulletins dated 13 October, and each was read in full between 06:53 and 06:54 BST on Wednesday 14 October, including the collapsed vulnerability panels that hold the severity and score. They list 177 CVE entries (derived by counting the identifiers). Two are repeats: the AEM bulletin lists CVE-2026-106631 twice, and CVE-2026-48378 appears in both the ColdFusion bulletin and the Content Credentials SDK bulletin, with a different score and weakness class in each. Counting the AEM repeat once gives 176. Counting every identifier once gives 175 (all derived). The six per-product counts SecurityWeek prints, AEM 36, ColdFusion 32, Content Credentials SDK 30, Photoshop 18, Substance 3D Stager 16 and Commerce 11, are exactly the number of entries on those six pages. So "roughly 176" is a fair sum of Adobe's pages. It is a count of lines in tables.

What the count does not establish is risk. Adobe's 25 June post says "some releases may not have individual CVEs assigned to each vulnerability when the release contains widespread fixes", which makes the figure a count of identifiers and not of flaws. It also says nothing about which of the products you run faces the internet. What separates the bulletins is concentrated. All 29 entries Adobe labels critical are in three server products: AEM, ColdFusion and Commerce. The eight bulletins at priority 3, a label Adobe words as "Act at your admin's discretion", contain no entry labelled critical and 70 entries scoring 7.0 or more on Adobe's own CVSS scale (derived).

Every bulletin also says Adobe is "not aware of any exploits in the wild" for the issues in that update. That is a sentence about 13 October. The record holds a Commerce bulletin that said the same on 11 August, one of whose flaws CISA added to its exploited-vulnerabilities catalogue 44 days later (derived). The sections below set out what the pages establish and what they do not, how Adobe's own clocks compare with the UK's, and what to do first, in order of exposure. Defender level only: no request strings, payloads or exploit steps appear here.

Stated and not stated: the record, line by line

"Not stated" means not found on the pages read in full. It does not mean the information does not exist. Time-stamps matter here: Adobe's pages, the CISA catalogue and the CVE records can all change after the times given.

What Adobe's pages, the CISA catalogue and the CVE Program records state about the 13 October bulletins, and what they do not. All read on 14 October 2026 (BST) unless a time is given.

The question	Stated	Not stated
Is anything exploited?	Each of the 11 bulletins says: "Adobe is not aware of any exploits in the wild for any of the issues addressed in this update." None of the 175 distinct ids is in CISA's Known Exploited Vulnerabilities (KEV) catalogue, version 2026.10.13, 1,741 entries, released 19:10 UTC on 13 October and re-read at 10:14 and 10:31 BST on 14 October. CISA's own enrichment of 70 of the 175 CVE records rates exploitation as none.	Anything after 13 October. Whether the 105 records with no CISA enrichment yet are exploited. The NCSC notes that KEV lists only exploitation that has already happened.
Which bulletins are priority 2?	Adobe's index and the three bulletins: Commerce (APSB26-153), ColdFusion (APSB26-144) and AEM (APSB26-152).	SecurityWeek says Commerce and AEM are the only products at priority 2. On Adobe's pages ColdFusion is too. This briefing follows Adobe.
What is ColdFusion's priority?	The bulletin header, its summary sentence and the index all say priority 2.	The solution table in the same bulletin gives a priority rating of 1 for both fixed versions. Adobe does not explain the difference. Read at 06:53, about 10:07 and about 10:32 BST, unchanged.
Why is the volume high?	Adobe's posts of 4 and 25 June say it uses frontier AI models and agentic analysis tooling continuously to find flaws in its products, and that twice-monthly bulletins are "the direct result of investing in improved vulnerability discovery".	Which of the 177 entries came from that work, or how many. The bulletins do not mention AI. SecurityWeek's link between Adobe's AI work and this month's volume is SecurityWeek's reading.
Who found the flaws?	Credit lines for external researchers cover 163 of the 176 identifiers (92.6 per cent, derived).	Who found the other 13, all in AEM, ColdFusion and Commerce. Adobe does not say.
Is the list complete?	CVE Program records exist for all 175 ids, published on 13 October between 18:15 and 21:27 UTC.	Two further Content Credentials SDK records, CVE-2026-95633 and CVE-2026-103297, are credited in that bulletin and were published at 21:27 UTC, yet are not in its list of 30 as read. If Adobe adds them the total becomes 179 entries (derived).

The 11 bulletins, with Adobe's labels and the fixed versions

The first table gives each bulletin's priority and entry count, with the severity words exactly as Adobe's pages print them. The second gives the versions Adobe lists as affected and fixed. Both are read from the bulletin pages; the totals are derived.

Entries and severity labels per bulletin, as printed on Adobe's 13 October bulletin pages (Trust Center). Totals derived.

Bulletin (priority)	CVE entries	Critical, high, medium
Experience Manager, APSB26-152 (2)	36 (35 distinct)	14, 0, 22
ColdFusion, APSB26-144 (2, but 1 in its table)	32	10, 21, 1
Content Credentials SDK, APSB26-163 (3)	30	0, 20, 10
Photoshop, APSB26-158 (3)	18	0, 16, 2
Substance 3D Stager, APSB26-170 (3)	16	0, 14, 2
Commerce, APSB26-153 (2)	11	5, 5, 1
FrameMaker, APSB26-172 (3)	10	0, 7, 3
Substance 3D Designer, APSB26-169 (3)	9	0, 1, 8
Dimension, APSB26-171 (3)	7	0, 5, 2
Substance 3D Sampler, APSB26-159 (3)	4	0, 2, 2
Bridge, APSB26-167 (3)	4	0, 3, 1
All 11 bulletins	177 (175 distinct ids)	29, 94, 54

Affected and fixed versions as listed on each bulletin page. Platforms: Windows and macOS for the desktop tools, Windows only for FrameMaker, all platforms for the server products and the SDK.

Product	Affected (and earlier)	Fixed
Experience Manager	Cloud Service 2026.9.28187; 6.5 Service Pack 25; 6.5 LTS Service Pack 3	Cloud Service 2026.9.28386; named hotfixes for 6.5 SP25 and 6.5 LTS SP3
ColdFusion	2025.0.13 and 2023.0.25, as listed	2025.0.14 and 2023.0.26
Content Credentials SDK	Rust c2pa-v0.90.15; C2PA Tool c2patool-v0.27.15; JS SDK 0.13.4	c2pa-v0.91.1; c2patool-v0.28.1; JS SDK 0.15.3
Photoshop	2026: 27.10; 2025: 26.11.7	27.11; 26.11.8
Substance 3D Stager	3.1.8	3.1.9
Commerce, B2B, Magento Open Source	Commerce 2.4.4 to 2.4.9 at 2026-sep; B2B lines 1.3.3, 1.3.4, 1.4.2, 1.5.2, 1.5.3; Open Source 2.4.6 to 2.4.9	2026-oct releases of Commerce 2.4.4 to 2.4.9, B2B, and Open Source 2.4.7 to 2.4.9; also 2.4.10-alpha1. None is listed for Open Source 2.4.6
FrameMaker	2026: 18.0.0.206; 2022: 17.0.9.866	18.0.1.312; 17.0.10.928
Substance 3D Designer	16.0.5	16.0.7
Dimension	4.1.8	4.1.9
Substance 3D Sampler	6.0.3	6.0.4
Bridge	16.0.7; LTS 15.1.8	16.0.8; LTS 15.1.9

Three of the 14 AEM entries Adobe labels critical carry scores of 7.7, 7.1 and 7.1. Adobe's own rating table puts critical at CVSS 9.0 to 10.0, and Adobe's CVE records for the same three say HIGH. Two Content Credentials SDK entries are labelled medium at 7.5, and their CVE records also say HIGH. On the score bands the critical count is 26, not 29 (derived), and the 26 are still all in AEM, ColdFusion and Commerce. Separately, three of the 177 scores differ between the bulletin and the CVE record: CVE-2026-106624 (9.8 against 10.0), CVE-2026-95639 (8.2 against 8.6) and the ColdFusion entry for CVE-2026-48378 (5.0 against 5.3, a record that matches the Content Credentials SDK entry instead). None changes where the weight sits. All three are reasons to read the bulletin line, not the summary line.

Where the weight sits: server products, one library and desktop tools

Grouping the 11 bulletins by what the software is gives a different picture from the headline. The three server products are web application software by design: ColdFusion is an application server, AEM a content management system and Commerce an online shop platform. Adobe's pages do not say whether any given installation is reachable from the internet, so this briefing calls them server products and leaves exposure to you. The attack-vector figures below are derived from the CVSS vectors Adobe prints for each entry.

The 11 bulletins grouped by kind of software, with Adobe's labels and vectors. Derived from the bulletin pages read on 14 October 2026.

Group	Bulletins and entries	Critical; CVSS 7.0+; network vector, no privileges
Server products (AEM, ColdFusion, Commerce)	3 bulletins, 79 entries (44.6%)	29; 55; 22
Content Credentials SDK, a library	1 bulletin, 30 entries (16.9%)	0; 22; 29
Desktop and creative tools (7 products)	7 bulletins, 68 entries (38.4%)	0; 48; 0
All	11 bulletins, 177 entries	29; 125; 51

The server products hold 44.6 per cent of the entries and 100 per cent of the entries Adobe labels critical. They also hold 22 of the 51 entries with a network vector and no privileges required; the other 29 are in the Content Credentials SDK, a library whose vector describes data it parses, not a service you expose. All 68 desktop entries have a local vector, and all 68 need a user to take an action, such as opening a file, according to Adobe's vectors (derived). On these vectors, desktop flaws rank below server flaws on exposure. That is not a reason to ignore them: 48 of the 68 score 7.0 or more.

Adobe's priority split is different again. Three of the 11 bulletins (27.3 per cent) are priority 2 and hold 79 of the 177 entries (44.6 per cent). Eight (72.7 per cent) are priority 3 and hold 98 (55.4 per cent), including 70 entries at 7.0 or more, 22 in the Content Credentials SDK and 48 in the desktop tools (derived). The priority label is a statement about likelihood of exploitation. It is not a severity score, and it is the first label an administrator sees on each bulletin.

Commerce: a bulletin that says no exploits, and a separate hotfix for an exploited flaw

The Commerce bulletin (APSB26-153, priority 2) fixes 11 entries: 5 labelled critical, 5 high and 1 medium, with impacts Adobe lists as arbitrary code execution, privilege escalation, arbitrary file system write and security feature bypass. Adobe's own "Authentication required to exploit?" field says No for 5 of the 11 entries, and 4 of those are the critical ones, scoring 10.0, 9.8, 9.3 and 9.3 (two code execution, two privilege escalation). The fifth critical entry requires authentication and a high-privilege account, according to its vector. This matches SecurityWeek's description.

The bulletin carries a note that matters more than any score. It refers to the critical update APSB26-146 of 7 September and says: "Please apply the Hotfix for CVE-2026-75650 in addition to the security updates released in this bulletin." APSB26-146 was priority 1 and said Adobe is aware of CVE-2026-75650 "being exploited in the wild". CISA added it to KEV on 8 September, one day after Adobe's bulletin. That bulletin is 36 days older than this one (derived). The 13 October sentence "not aware of any exploits" covers the issues in the October update. It does not cover the September hotfix, which is a separate install.

The older record is a warning about the sentence itself. APSB26-92, the 11 August Commerce bulletin, was also priority 2 and also said Adobe was "not aware of any exploits in the wild". CISA's KEV entry for CVE-2026-71362, a flaw in that bulletin, was added on 24 September, 44 days later (derived), with a due date of 27 September. Adobe's page for APSB26-92 shows "Last updated on Aug 18, 2026" and still carries the "not aware" sentence on 14 October. KEV does not say when exploitation began, so the 44 days is a listing delay, not an exploitation delay. On Adobe's index, Commerce has had seven bulletins in 2026: six at priority 2 and the 7 September one at priority 1. Two of the six bulletins before this one (APSB26-146 and APSB26-92) now have a CVE in KEV (derived from the index and the KEV notes).

One more line in the version table needs reading twice. Magento Open Source 2.4.6 at 2026-sep is listed as affected, but the fixed versions listed for Open Source are 2.4.7, 2.4.8, 2.4.9 and 2.4.10-alpha1. Adobe does not say why 2.4.6 has no listed fix, and the September bulletin APSB26-138 lists the same three Open Source lines. If you run Open Source 2.4.6, the bulletin gives you no patch to apply.

ColdFusion: priority 2 in the header, priority 1 in the table, and a clean run of priority 1 before it

The ColdFusion bulletin (APSB26-144) fixes 32 entries: 10 labelled critical, 21 high and 1 medium. Adobe's impact words are arbitrary code execution (18), privilege escalation (8), application denial of service (2) and one each of file system write, file system read, security feature bypass and memory exposure. Eleven entries have a network vector, no privileges required and no user interaction in Adobe's vectors, five of them labelled critical (derived). Adobe prints no "authentication required" field for ColdFusion or AEM, so the vectors are the only evidence on that point.

The priority is the odd part. The header says "Adobe has released a priority 2 security update" and the index says priority 2. The solution table, which tells administrators what to install, says priority rating 1 for ColdFusion 2025.0.14 and for 2023.0.26. Adobe's index shows seven earlier ColdFusion bulletins in 2026, from January to September, every one at priority 1 (derived from the index). This is the first at a lower priority, and its own table still says 1. Adobe has not said which is intended, and an administrator who reads the table gets "act as soon as possible" while one who reads the header gets "act within 30 days".

There is history behind the product's rating. KEV holds 16 ColdFusion entries. The most recent, CVE-2026-48282, was added on 7 July 2026, seven days after APSB26-68 of 30 June, a priority 1 bulletin in which Adobe said it was aware of exploitation in limited attacks (derived). Separately, CISA's enrichment marks six ColdFusion entries and one AEM entry in this month's bulletins as automatable with total technical impact, each with exploitation "none" at the time of CISA's assessment on 13 October. That is an assessment, not a finding of exploitation. Adobe's bulletin also points to its lockdown guides, the updated serial filter documentation and a current JDK or JRE, which are the configuration controls it recommends alongside the update.

AEM: 36 entries, one repeated, three at 10.0 and a Cloud Service line that is not an on-premises line

The AEM bulletin (APSB26-152, priority 2) lists 36 entries, 35 distinct. Fourteen are labelled critical, 22 medium and none high. Three score 10.0, all the same class (incorrect authorization), with a network vector, no privileges and no user interaction in Adobe's vectors. Six of the 14 critical entries have no privileges required (derived), and Adobe does not print an authentication field for AEM, so those six are the ones to check first on any author or publish tier that can be reached from outside.

The page treats AEM Cloud Service and AEM 6.5 differently, and this matters for who has to act. Eight entries are noted as fixed in Cloud Service 2026.9.28386, three as not affecting Cloud Service, and 25 name only the GRANITE-75052 hotfix for AEM 6.5 and 6.5 LTS, with no Cloud Service line (derived from the notes column). The Solution table lists seven hotfix packages for 6.5 Service Pack 25 and six for 6.5 LTS Service Pack 3. Whether your Cloud Service environment is already at the fixed version is something the bulletin cannot tell you; the environment's own version can. Eight of the 35 distinct ids carry no credit line, the largest uncredited group in the set.

What Adobe says about AI-found flaws, and what the bulletins show

SecurityWeek writes that Adobe "has been using frontier AI models to hunt for flaws in its own code", which it says helps explain the volume. Adobe does publish primary statements, and they are narrower. In part 2 of its June security series (4 June 2026) Adobe describes a penetration-testing harness powered by frontier AI models that in one engagement identified "nearly 20 confirmed findings across multiple products in a single day", and says engineering teams "continue to review, validate, and approve all changes before deployment". In its 25 June post Adobe says it is applying frontier models and agentic tooling "continuously" across its products, that the new twice-monthly schedule starts on 14 July, and that the cadence is "the direct result of investing in improved vulnerability discovery". Adobe has a commercial interest in presenting its own security programme as keeping pace.

None of this says how many of the 177 entries came from that work. The October bulletins do not mention AI at all. The only provenance the bulletins print is the acknowledgments, and those credit external researchers for 163 of the 176 identifiers (derived). The credits are concentrated: the five most-credited names account for 111 of the 163 credited identifiers (68.1 per cent, derived), and the single most-credited name appears in seven bulletins. The 13 identifiers without a credit line are all in AEM (8), ColdFusion (4) and Commerce (1). Adobe's September bulletins add a note that, from 11 August 2026, it "may assign a single CVE identifier to internally discovered vulnerabilities with the same severity rating and CWE category" when a release has systemic fixes. That note is not on the October pages, and it is a second reason a CVE count is not a flaw count.

So the record supports this much: Adobe says it uses AI to find flaws and ships more often because of it; most identifiers in these bulletins are credited to outside researchers; the share Adobe found itself, with or without AI, is not stated. The quality of AI-assisted discovery cannot be judged from these pages. A comparable question about credits was asked of another vendor in an earlier briefing on Chrome 155, and the same discipline applies: a credit line shows who reported, not how.

Four labels that stand in for a decision

A label is not a control. Each of these four is on Adobe's pages, each is accurate as far as it goes, and each can be mistaken for an answer to "do we patch now".

Four labels on Adobe's 13 October pages: what Adobe's own definition says, and what the label does not tell you. Definitions from Adobe's Trust Center rating-system text, read 14 October 2026.

The label	What Adobe says it means	What it does not tell you
Priority 3	"Act at your admin's discretion". "Active exploitation is unlikely based on the product's history and nature of the vulnerability."	The severity of the flaw. Eight priority 3 bulletins hold 70 entries scoring 7.0 or more, and Cyber Essentials treats a score of 7.0 as the line for a 14 day clock.
Priority 2	"Act within 30 days". A "high likelihood of exploitation", with no known active exploits.	Whether 30 days meets UK expectations. The 30th day is 12 November, 16 days after the Cyber Essentials date of 27 October and 25 days after the NCSC's 5 day figure for internet-facing services (derived).
"Not aware of any exploits in the wild"	A statement about the issues in the update, on the date of the bulletin.	What happens next. A Commerce bulletin said it on 11 August and still does; a flaw from it went into KEV on 24 September. The September hotfix for an exploited Commerce flaw is outside this sentence.
Critical	CVSS 9.0 to 10.0, in Adobe's October rating table.	That critical is the threshold that matters. The AEM page applies it to three entries at 7.1 to 7.7, and the Cyber Essentials clock starts at 7.0, so high entries are on it too.

Adobe's rating-system text itself says its priorities help "customers in managed environments" prioritise, based on "Adobe's assessment of exploitability" and "historical attack patterns for the relevant product". It is a useful input. It is not your risk decision.

UK: seven sets of dates and duties for one release, and who they bind

Adobe's priorities are advice to administrators. They are not a UK rule. The table sets them beside the documents that are, each as read from the page named on 14 October 2026. Dates are counted from 13 October (derived).

Patching clocks and duties for the 13 October release, as read from Adobe's rating text, the NCSC's Cyber Essentials requirements v3.3 (April 2026), the NCSC vulnerability management guidance (version 2.1, reviewed 1 May 2026), the NCSC Cyber Assessment Framework 4.0 (principle B4), the ICO and UK GDPR Article 32.

Source	What it says	Date for 13 October (derived)
Adobe priority 2	"Act within 30 days".	12 November
Adobe priority 3	"Act at your admin's discretion".	No date
Cyber Essentials v3.3, security update management	Update within 14 days where it fixes flaws the vendor calls critical or high risk, scored CVSS v3 7 or above, or where no detail is given. "If such an update covers any 'critical' or 'high risk' issues then it must be installed within 14 days."	27 October, for all 11 bulletins
NCSC, update by default	Best-practice timescales that "apply to all updates, regardless of the vulnerability severity": internet-facing services and software 5 days; operating system and applications 7 days; internal or air-gapped 14 days.	18, 20 and 27 October
NCSC, responding to active exploitation	If a flaw is on KEV and internet accessible, automatable and giving total control: install within 24 hours, plus an incident response provider; 48 and 72 hour rows for the other cases.	None of the 175 ids is on KEV in the catalogue read
NCSC CAF 4.0, B4.d (written for public sector and large organisations)	Achieved when announced vulnerabilities "are tracked, prioritised and externally exposed vulnerabilities are mitigated (e.g. by patching) promptly".	No number of days
UK GDPR Article 32 and the ICO	"Appropriate technical and organisational measures" for a level of security appropriate to the risk. The ICO calls Cyber Essentials a good starting point and a base only; its guidance is under review after the Data (Use and Access) Act.	No number of days

Three readings follow from the table. First, every one of the 11 bulletins contains at least one entry at CVSS 7.0 or above (derived), so under Cyber Essentials v3.3 the 14 day clock applies to all 11, priority 3 included, for software in scope. The requirement's caution covers this directly: an update that bundles several severities is on the clock if any entry is critical or high. Second, 27 October is both the Cyber Essentials date and the next scheduled Adobe bulletin (the fourth Tuesday), and the scheduled dates from 13 October to 22 December are all 14 days apart (derived). An estate that meets Cyber Essentials for Adobe software is on a continuous 14 day cycle. Third, the NCSC's 5 day figure for internet-facing services is the tightest and falls on a Sunday, 18 October.

On sector: the premise that AEM, ColdFusion and Commerce are common in UK public sector bodies and retailers is plausible and is not something any source read here measures. No page gives a UK installation count, so this briefing makes no claim about prevalence. What can be said from the pages is who the duties bind. The NCSC's CAF page is marked as written for public sector and large organisations, and its B4.d outcome is about promptly mitigating externally exposed vulnerabilities. Where a Commerce store, an AEM site or a ColdFusion application holds or processes personal data, UK GDPR Article 32 applies to the controller and the processor. The ICO's data security guide points to Cyber Essentials as the base. If a compromise becomes a notifiable personal data breach, the ICO's guidance says the report goes to the ICO without undue delay and not later than 72 hours after becoming aware of it. Payment card standards also bind shops that take cards; they were not read for this briefing and are not described here.

What to do, in order of exposure

The order is by exposure: internet-facing Commerce, AEM and ColdFusion first, then the library, then creative tools on managed desktops. The dates assume 13 October as day 0.

The NCSC's update-by-default page gives the 5, 7 and 14 day figures, its active exploitation page gives the KEV table, and its page on owning the risk of not updating sets out the senior decision. For the arithmetic of how a count can mislead in a similar bundle, see the earlier briefing on Cisco's October bundle; for the federal three day clock that KEV listing triggers in the United States, see the briefing on KEV deadlines.

What could not be verified

Adobe's website refuses ordinary command-line requests with an access-denied response, so the Trust Center index, the 11 bulletins, the blog posts and the four earlier bulletins were read in a web browser on 14 October, with no form filled and no check bypassed. The SecurityWeek page, the CISA file, the CVE Program records and the NCSC, ICO and legislation pages were read directly. Remaining limits:

The question this leaves

When your change calendar reads Adobe's word "priority 3" beside Photoshop, FrameMaker and the Content Credentials SDK, is anyone also reading the 70 flaws behind that label that score 7.0 or more, and the 14 days the Cyber Essentials requirements give them? And when it reads "not aware of any exploits" beside Commerce, who has checked that the September hotfix for the exploited flaw is on every store, by name?

Key facts