SecurityWeek reported on 13 October that Adobe issued 11 security advisories covering about 176 fixed flaws. Adobe Experience Manager (AEM) had 36, ColdFusion 32, the Content Credentials SDK 30, Photoshop 18, Substance 3D Stager 16 and Commerce 11. Fixes also reached five more tools: FrameMaker, Dimension, Substance 3D Sampler, Substance 3D Designer and Bridge. In each, several of the flaws let an attacker run code of their choosing.
Adobe says it knows of no attacks in the wild, SecurityWeek wrote. Most advisories carry priority 3, meaning Adobe does not expect attacks. AEM and Commerce are rated 2, and attackers have targeted Commerce before. That rating gauges attack odds, not how bad a flaw is. Critical flaws were reported in AEM, ColdFusion and Commerce. Some Commerce flaws need no login: a stranger could run code or gain extra access.
SecurityWeek said Adobe used advanced AI models to search its own code, which helps explain the count. More finds led Adobe to publish twice a month, on the second and fourth Tuesday, instead of monthly. Teams running AEM, ColdFusion or Commerce can book patch testing after each of those Tuesdays, and test the critical fixes first.