Threat reportVulnerabilityTL-2026-3430
Adobe Patches ~140 Vulnerabilities Across 10 Products (ColdFusion, Content Credentials SDK, Photoshop, Commerce, others)
Adobe Patches ~140 Vulnerabilities Across 10 Products (TL-2026-3430), also tracked as APSB26-144, is a high-severity software vulnerability, first published 2026-10-13. It has no confirmed attribution, affects Adobe ColdFusion, maps to 2 MITRE ATT&CK techniques (T1190, T1203), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 2MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-3430
- Threat ID
- TL-2026-3430
- Also known as
- APSB26-144
- Severity
- HIGH
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, retail, ecommerce, news - media, creative
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 11
How Adobe Patches ~140 Vulnerabilities Across 10 Products works
Adobe released security updates on 2026-10-13 addressing approximately 140 vulnerabilities across 10 products, led by ColdFusion (32), Content Credentials SDK (30), Photoshop (18), Substance 3D Stager (16) and Adobe Commerce (11). Adobe states it is not aware of any in-the-wild exploitation of these flaws.
Adobe published 10 security advisories on 2026-10-13 covering roughly 140 vulnerabilities. Per SecurityWeek, ColdFusion (bulletin APSB26-144) received 32 fixes, including critical bugs enabling arbitrary code execution and privilege escalation. Content Credentials SDK received 30 fixes, mostly high-severity security feature bypass issues with denial-of-service potential. Photoshop received 18 fixes, nearly all enabling arbitrary code execution, and Substance 3D Stager received 16 fixes, multiple of them high-severity arbitrary code execution flaws.
Adobe Commerce received 11 fixes, including critical unauthenticated code execution and privilege escalation bugs. Adobe rated Commerce Priority 2 because of historical threat-actor targeting of the platform; most other advisories were rated Priority 3 (lower exploitation likelihood). FrameMaker, Dimension, Substance 3D Sampler, Substance 3D Designer and Bridge each received fixes for multiple arbitrary code execution vulnerabilities.
The source article does not list CVE IDs, CVSS scores or affected version ranges, and Adobe's bulletin pages could not be retrieved during research (HTTP 403), so those fields are left empty rather than inferred. Adobe reportedly used frontier AI models to help identify the vulnerabilities, with human engineers validating all changes, and has moved to twice-monthly security bulletins (second and fourth Tuesdays) because of the increased discovery volume. No exploitation, public PoC or threat-actor activity is reported for this release. Separately, CISA KEV lists two earlier Adobe Commerce/Magento flaws (CVE-2026-75650 added 2026-09-08 and CVE-2026-71362 added 2026-09-24); these are distinct from this release and are cited only as context for the Priority 2 rating.
MITRE ATT&CK techniques used in TL-2026-3430
Initial Access
T1190 Exploit Public-Facing Application
Execution
Affected products and versions in Adobe Patches ~140 Vulnerabilities Across 10 Products
- Adobe — ColdFusion
Vulnerable versions: See APSB26-144
Fixed in: See APSB26-144 - Adobe — Commerce
Vulnerable versions: See Adobe Commerce October 2026 bulletin
Fixed in: See Adobe Commerce October 2026 bulletin - Adobe — Content Credentials SDK
Vulnerable versions: See Adobe bulletin
Fixed in: See Adobe bulletin - Adobe — Photoshop
Vulnerable versions: See Adobe bulletin
Fixed in: See Adobe bulletin - Adobe — Substance 3D Stager
Vulnerable versions: See Adobe bulletin
Fixed in: See Adobe bulletin - Adobe — FrameMaker
Vulnerable versions: See Adobe bulletin
Fixed in: See Adobe bulletin - Adobe — Dimension
Vulnerable versions: See Adobe bulletin
Fixed in: See Adobe bulletin - Adobe — Substance 3D Sampler
Vulnerable versions: See Adobe bulletin
Fixed in: See Adobe bulletin - Adobe — Substance 3D Designer
Vulnerable versions: See Adobe bulletin
Fixed in: See Adobe bulletin - Adobe — Bridge
Vulnerable versions: See Adobe bulletin
Fixed in: See Adobe bulletin
Remediation for Adobe Patches ~140 Vulnerabilities Across 10 Products
Patches
- See Adobe bulletins at https://helpx.adobe.com/security.html for fixed versions per product
Immediate actions
- Apply the October 2026 Adobe security updates for ColdFusion (APSB26-144), Adobe Commerce, Photoshop, Substance 3D Stager, Content Credentials SDK, FrameMaker, Dimension, Substance 3D Sampler, Substance 3D Designer and Bridge
- Prioritize internet-facing Adobe Commerce and ColdFusion servers, as Adobe rated Commerce Priority 2
Longer-term hardening
- Track Adobe's twice-monthly bulletin cadence (second and fourth Tuesdays) in patch-management SLAs
- Monitor CISA KEV for Adobe additions
Timeline of Adobe Patches ~140 Vulnerabilities Across 10 Products
- Adobe publishes ColdFusion bulletin APSB26-38, the first in the 2026 series of ColdFusion security updates referenced for context.
- Adobe publishes ColdFusion bulletin APSB26-82 (ColdFusion 2025 Update 11 / 2023 Update 22).
- Adobe publishes ColdFusion bulletin APSB26-90 covering code execution, privilege escalation, security feature bypass, DoS and memory exposure.
- CISA adds Adobe Commerce/Magento CVE-2026-75650 to the KEV catalog; ColdFusion bulletin APSB26-119 is also released, resolving critical and important flaws.
- CISA adds a second Adobe Commerce/Magento flaw, CVE-2026-71362, to the KEV catalog.
- Adobe states it is not aware of any in-the-wild exploitation; Commerce is rated Priority 2 and most other advisories Priority 3.
- Adobe releases 10 security advisories fixing about 140 vulnerabilities across ColdFusion (APSB26-144), Content Credentials SDK, Photoshop, Substance 3D Stager, Commerce and five other products.
Sources cited for Adobe Patches ~140 Vulnerabilities Across 10 Products
- SecurityWeek: Adobe Patches 140 Vulnerabilities Across 10 Products
- Adobe Security Bulletins index
- CISA Known Exploited Vulnerabilities Catalog
- Adobe Security Bulletin APSB26-119 (ColdFusion, September 2026)
- Adobe Security Bulletin APSB26-90 (ColdFusion, August 2026)
- Adobe Security Bulletin APSB26-82 (ColdFusion, July 2026)
- Adobe Security Bulletin APSB26-38 (ColdFusion, April 2026)
- watchTowr Labs: ColdFusion APSB26-68 CVE Bonanza
- SecurityWeek: Adobe Patches Critical ColdFusion Vulnerabilities
Detection coverage for TL-2026-3430
As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3430 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.