# Adobe Patches ~140 Vulnerabilities Across 10 Products (ColdFusion, Content Credentials SDK, Photoshop, Commerce, others)

> Adobe released security updates on 2026-10-13 addressing approximately 140 vulnerabilities across 10 products, led by ColdFusion (32), Content Credentials SDK (30), Photoshop (18), Substance 3D Stager (16) and Adobe Commerce (11). Adobe states it is not aware of any in-the-wild exploitation of these flaws.

- **Published:** 2026-10-13T17:44:27Z
- **Last reviewed:** 2026-10-13T17:44:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3430
- **ID:** TL-2026-3430
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Adobe published 10 security advisories on 2026-10-13 covering roughly 140 vulnerabilities. Per SecurityWeek, ColdFusion (bulletin APSB26-144) received 32 fixes, including critical bugs enabling arbitrary code execution and privilege escalation. Content Credentials SDK received 30 fixes, mostly high-severity security feature bypass issues with denial-of-service potential. Photoshop received 18 fixes, nearly all enabling arbitrary code execution, and Substance 3D Stager received 16 fixes, multiple of them high-severity arbitrary code execution flaws.

Adobe Commerce received 11 fixes, including critical unauthenticated code execution and privilege escalation bugs. Adobe rated Commerce Priority 2 because of historical threat-actor targeting of the platform; most other advisories were rated Priority 3 (lower exploitation likelihood). FrameMaker, Dimension, Substance 3D Sampler, Substance 3D Designer and Bridge each received fixes for multiple arbitrary code execution vulnerabilities.

The source article does not list CVE IDs, CVSS scores or affected version ranges, and Adobe's bulletin pages could not be retrieved during research (HTTP 403), so those fields are left empty rather than inferred. Adobe reportedly used frontier AI models to help identify the vulnerabilities, with human engineers validating all changes, and has moved to twice-monthly security bulletins (second and fourth Tuesdays) because of the increased discovery volume. No exploitation, public PoC or threat-actor activity is reported for this release. Separately, CISA KEV lists two earlier Adobe Commerce/Magento flaws (CVE-2026-75650 added 2026-09-08 and CVE-2026-71362 added 2026-09-24); these are distinct from this release and are cited only as context for the Priority 2 rating.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution

## Sources

- [SecurityWeek: Adobe Patches 140 Vulnerabilities Across 10 Products](https://www.securityweek.com/adobe-patches-140-vulnerabilities-across-10-products/)
- [Adobe Security Bulletins index](https://helpx.adobe.com/security.html)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [Adobe Security Bulletin APSB26-119 (ColdFusion, September 2026)](https://helpx.adobe.com/security/products/coldfusion/apsb26-119.html)
- [Adobe Security Bulletin APSB26-90 (ColdFusion, August 2026)](https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html)
- [Adobe Security Bulletin APSB26-82 (ColdFusion, July 2026)](https://helpx.adobe.com/security/products/coldfusion/apsb26-82.html)
- [Adobe Security Bulletin APSB26-38 (ColdFusion, April 2026)](https://helpx.adobe.com/security/products/coldfusion/apsb26-38.html)
- [watchTowr Labs: ColdFusion APSB26-68 CVE Bonanza](https://labs.watchtowr.com/its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bonanza/)
- [SecurityWeek: Adobe Patches Critical ColdFusion Vulnerabilities](https://www.securityweek.com/adobe-patches-critical-coldfusion-vulnerabilities/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3430