Summary
Adobe's September 2026 security updates patch vulnerabilities across eight product families: Commerce/Magento, ColdFusion, Campaign Classic, Acrobat/Reader, Experience Manager, Photoshop, Illustrator, and Animate. The flaws could allow arbitrary code execution, privilege escalation, security feature bypass, file system read/write, memory exposure, and denial-of-service. The most urgent is CVE-2026-75650 (CVSS 10.0) in Adobe Commerce and Magento Open Source, an unauthenticated template-engine flaw already exploited in the wild and fixed by a separate out-of-band hotfix on September 7 that must be applied in addition to the September update.
Take Action:
If you run Adobe Commerce or Magento Open Source, apply the out-of-band hotfix for CVE-2026-75650 immediately! Adobe is aware of this flaw being exploited in the wild, it carries a CVSS score of 10.0, and it can be triggered without authentication. Next, update ColdFusion and Adobe Campaign Classic, both of which received Adobe's highest priority rating and contain critical flaws that could lead to arbitrary code execution. Then apply the September Adobe Commerce security update, which is separate from the hotfix and must be installed in addition to it. After that, update Adobe Experience Manager and Acrobat and Reader. Finally, update Photoshop, Illustrator, and Animate. If you can't update right away, restrict network access to Commerce, ColdFusion, Campaign Classic, and Experience Manager servers, and avoid opening untrusted PDFs and untrusted image or project files in Acrobat, Reader, Photoshop, Illustrator, and Animate until patches are applied.
Read the full article on BeyondMachines
This article was originally published on BeyondMachines
Top comments (0)