Adobe October 2026 bulletins: unauthenticated CVSS 9.0 to 10.0 flaws, most leading to code execution, in ColdFusion (APSB26-144), Experience Manager (APSB26-152) and Commerce and Magento (APSB26-153), none reported exploited

Adobe's 2026-10-13 bulletins put critical fixes into three server products: ColdFusion, Experience Manager and Commerce. Adobe says it is not aware of any exploits in the wild for the ColdFusion issues (Adobe ColdFusion APSB26-144, 2026-10-13). ColdFusion 2025 up to 2025.0.13 and 2023 up to 2023.0.25 are affected and 2025.0.14 and 2023.0.26 fix them; the bulletin lists five network flaws that need no privileges at CVSS 9.0 or above: an unrestricted file upload leading to arbitrary code execution (CVE-2026-105899, 10.0), a server-side request forgery rated privilege escalation (CVE-2026-106622, 10.0), an input-validation flaw leading to code execution (CVE-2026-106624, 9.8), a code injection rated privilege escalation (CVE-2026-106621, 9.1) and a further input-validation code-execution flaw (CVE-2026-106619, 9.0, high complexity), besides code-execution flaws that need a low-privileged account at 9.9 (Adobe ColdFusion APSB26-144, 2026-10-13).

Experience Manager APSB26-152 covers Cloud Service 2026.9.28187 and earlier, 6.5 up to Service Pack 25 and 6.5 LTS up to Service Pack 3: three incorrect-authorization flaws that lead to arbitrary code execution are scored 10.0 with no privileges required (CVE-2026-90532, CVE-2026-48383, CVE-2026-48382), fixed by Cloud Service 2026.9.28386 and, on 6.5 and 6.5 LTS, by per-issue hotfixes, and Adobe is not aware of exploits of these either (Adobe Experience Manager APSB26-152, 2026-10-13). Commerce and Magento APSB26-153 fixes a template-engine injection leading to code execution (CVE-2026-103849, 10.0, which Adobe marks as needing no authentication) and an incorrect-authorization code-execution flaw (CVE-2026-92909, 9.8, which Adobe's note tags B2B) in builds up to the 2026-sep release; the fixes are the 2026-oct builds, Adobe Commerce B2B has its own 2026-oct builds, Magento Open Source gets them for 2.4.9, 2.4.8 and 2.4.7, and Adobe asks customers to apply the CVE-2026-75650 hotfix from its September APSB26-146 update as well, and Adobe is likewise not aware of exploits (Adobe Commerce APSB26-153, 2026-10-13).