Adobe Security Updates — October 2026

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 26

• Critical 10.0
  CVE-2026-103849 Public exploit Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
  EPSS 1.2%
• Critical 10.0
  CVE-2026-105899 ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)
  EPSS 1%
• Critical 10.0
  CVE-2026-106622 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
• Critical 10.0
  CVE-2026-106624 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
  EPSS 1.1%
• Critical 10.0
  CVE-2026-48382 Adobe Experience Manager | Incorrect Authorization (CWE-863)
• Critical 10.0
  CVE-2026-48383 Adobe Experience Manager | Incorrect Authorization (CWE-863)
• Critical 10.0
  CVE-2026-90532 Adobe Experience Manager | Incorrect Authorization (CWE-863)
• Critical 9.9
  CVE-2026-103848 Adobe Experience Manager | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
  EPSS 1.4%
• Critical 9.9
  CVE-2026-105895 Adobe Experience Manager | Improper Input Validation (CWE-20)
• Critical 9.9
  CVE-2026-105903 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
• Critical 9.9
  CVE-2026-106612 ColdFusion | Incorrect Authorization (CWE-863)
• Critical 9.9
  CVE-2026-75732 Adobe Experience Manager | Incorrect Authorization (CWE-863)
• Critical 9.8
  CVE-2026-92909 Adobe Commerce | Incorrect Authorization (CWE-863)
• Critical 9.6
  CVE-2026-106620 ColdFusion | Incorrect Authorization (CWE-863)
• Critical 9.6
  CVE-2026-75994 ColdFusion | Incorrect Authorization (CWE-863)
• Critical 9.6
  CVE-2026-90531 Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
  EPSS 1.4%
• Critical 9.3
  CVE-2026-100133 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
  EPSS 1%
• Critical 9.3
  CVE-2026-106629 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
• Critical 9.3
  CVE-2026-106630 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
• Critical 9.3
  CVE-2026-83662 Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
  EPSS 1%
• Critical 9.3
  CVE-2026-90530 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
• Critical 9.3
  CVE-2026-91013 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
• Critical 9.1
  CVE-2026-106621 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
• Critical 9.1
  CVE-2026-106626 Adobe Experience Manager | Improper Input Validation (CWE-20)
• Critical 9.1
  CVE-2026-92464 Adobe Commerce | Improper Input Validation (CWE-20)

1 more in the full list below.

All vulnerabilities 177