Adobe Security Updates — September 2026

Tuesday, 8 September 2026

Vulnerabilities: 168
Critical: 7
High: 43
Zero-days: 1
Public exploit: 1

Exploited 1

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

Critical 10.0
CVE-2026-75650 Zero-day Public exploit Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
EPSS 99%

Critical 6

Critical 10.0
CVE-2026-82004 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
EPSS 3.3%
Critical 9.9
CVE-2026-19232 Adobe Experience Manager | Incorrect Authorization (CWE-863)
EPSS 1%
Critical 9.9
CVE-2026-48273 ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)
EPSS 1.3%
Critical 9.3
CVE-2026-76200 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Critical 9.3
CVE-2026-76201 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Critical 9.1
CVE-2026-75746 ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

All vulnerabilities 168

Critical7 Show

Critical 10.0
CVE-2026-75650 Zero-day Public exploit Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
EPSS 99%
Critical 10.0
CVE-2026-82004 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
EPSS 3.3%
Critical 9.9
CVE-2026-19232 Adobe Experience Manager | Incorrect Authorization (CWE-863)
EPSS 1%
Critical 9.9
CVE-2026-48273 ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)
EPSS 1.3%
Critical 9.3
CVE-2026-76200 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Critical 9.3
CVE-2026-76201 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Critical 9.1
CVE-2026-75746 ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

High43 Show

High 8.8
CVE-2026-81996 Acrobat Reader | Incorrect Authorization (CWE-863)
High 8.7
CVE-2026-77111 Adobe Commerce | Incorrect Authorization (CWE-863)
High 8.6
CVE-2026-75990 Illustrator | Incorrect Authorization (CWE-863)
High 8.6
CVE-2026-75991 Illustrator | Improper Input Validation (CWE-20)
High 8.6
CVE-2026-76190 ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)
High 8.6
CVE-2026-76199 Photoshop Desktop | Uncontrolled Search Path Element (CWE-427)
High 8.6
CVE-2026-77109 Adobe Commerce | Incorrect Authorization (CWE-863)
High 8.6
CVE-2026-77774 Adobe Commerce | Incorrect Authorization (CWE-863)
High 8.5
CVE-2026-75993 ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)
High 8.4
CVE-2026-75999 ColdFusion | Improper Input Validation (CWE-20)
High 8.2
CVE-2026-76191 Animate | Improper Control of Generation of Code ('Code Injection') (CWE-94)
High 8.2
CVE-2026-76202 Adobe Commerce | Incorrect Authorization (CWE-863)
High 8.2
CVE-2026-81994 Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
High 7.8
CVE-2026-75631 Photoshop Desktop | Out-of-bounds Write (CWE-787)
High 7.8
CVE-2026-75771 Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
High 7.8
CVE-2026-75862 Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
High 7.8
CVE-2026-75863 Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
High 7.8
CVE-2026-75992 Illustrator | Out-of-bounds Write (CWE-787)
High 7.8
CVE-2026-79907 Acrobat Reader | Double Free (CWE-415)
High 7.8
CVE-2026-79908 Acrobat Reader | Out-of-bounds Write (CWE-787)
High 7.8
CVE-2026-79909 Acrobat Reader | Use After Free (CWE-416)
High 7.8
CVE-2026-80161 Acrobat Reader | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)
High 7.8
CVE-2026-81973 Acrobat Reader | Use After Free (CWE-416)
High 7.8
CVE-2026-81975 Acrobat Reader | Use After Free (CWE-416)
High 7.8
CVE-2026-81976 Acrobat Reader | Use After Free (CWE-416)
High 7.8
CVE-2026-81979 Acrobat Reader | Out-of-bounds Write (CWE-787)
High 7.8
CVE-2026-81980 Acrobat Reader | Out-of-bounds Write (CWE-787)
High 7.8
CVE-2026-81981 Acrobat Reader | Out-of-bounds Write (CWE-787)
High 7.8
CVE-2026-81983 Acrobat Reader | Out-of-bounds Write (CWE-787)
High 7.8
CVE-2026-81985 Acrobat Reader | Use After Free (CWE-416)
High 7.8
CVE-2026-81986 Acrobat Reader | Use After Free (CWE-416)
High 7.8
CVE-2026-81987 Acrobat Reader | Integer Overflow or Wraparound (CWE-190)
High 7.8
CVE-2026-81988 Acrobat Reader | Use After Free (CWE-416)
High 7.8
CVE-2026-81989 Acrobat Reader | Use After Free (CWE-416)
High 7.8
CVE-2026-81990 Acrobat Reader | Use After Free (CWE-416)
High 7.8
CVE-2026-81992 Acrobat Reader | Heap-based Buffer Overflow (CWE-122)
High 7.8
CVE-2026-82005 Photoshop Desktop | Out-of-bounds Write (CWE-787)
High 7.8
CVE-2026-82006 Photoshop Desktop | Heap-based Buffer Overflow (CWE-122)
High 7.8
CVE-2026-82007 Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
High 7.6
CVE-2026-77110 Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
EPSS 1.1%
High 7.5
CVE-2026-75998 ColdFusion | Improper Access Control (CWE-284)
High 7.5
CVE-2026-77108 Adobe Commerce | Incorrect Authorization (CWE-863)
High 7.4
CVE-2026-76196 Photoshop Mobile | Session Fixation (CWE-384)

Medium117 Show

Low1 Show

Low 3.5
CVE-2026-75726 Adobe Experience Manager | Improper Input Validation (CWE-20)