Adobe Security Updates - October 2026
Roundup of Adobe security advisories published in October 2026.
CVE search metadata
CVE search record: CVE-2026-100133. Severity: critical. CVSS: 9.3. KEV: no. Product: Adobe Commerce. Brief: Adobe Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-adobe-security-updates/
CVE search record: CVE-2026-103849. Severity: critical. CVSS: 10.0. KEV: no. Brief: Adobe Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-adobe-security-updates/
CVE search record: CVE-2026-91013. Severity: critical. CVSS: 9.3. KEV: no. Brief: Adobe Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-adobe-security-updates/
CVE search record: CVE-2026-92909. Severity: critical. CVSS: 9.8. KEV: no. Brief: Adobe Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-adobe-security-updates/
CVE search record: CVE-2026-105895. Severity: critical. CVSS: 9.9. KEV: no. Brief: Adobe Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-adobe-security-updates/
CVE search record: CVE-2026-106626. Severity: critical. CVSS: 9.1. KEV: no. Product: Experience Manager. Brief: Adobe Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-adobe-security-updates/
CVE search record: CVE-2026-106629. Severity: critical. CVSS: 9.3. KEV: no. Brief: Adobe Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-adobe-security-updates/
CVE search record: CVE-2026-106630. Severity: critical. CVSS: 9.3. KEV: no. Product: Experience Manager. Brief: Adobe Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-adobe-security-updates/
CVE search record: CVE-2026-75732. Severity: critical. CVSS: 9.9. KEV: no. Brief: Adobe Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-adobe-security-updates/
What's new
This roundup covers 15 Adobe security vulnerabilities. CVSS base scores range from 9.1 to 10.0. None are reported as actively exploited at the time of release. The issues affect Adobe Commerce, Commerce, Experience Manager.
Summary
| CVE | Product | Severity | CVSS | EPSS | KEV | Source |
|---|---|---|---|---|---|---|
| CVE-2026-100133 | Adobe Commerce | Critical | 9.3 | no | NVD (authoritative) | |
| CVE-2026-103849 | Commerce | Critical | 10.0 | no | NVD (authoritative) | |
| CVE-2026-91013 | Commerce | Critical | 9.3 | no | NVD (authoritative) | |
| CVE-2026-92464 | Commerce | no | NVD (authoritative) | |||
| CVE-2026-92909 | Commerce | Critical | 9.8 | no | NVD (authoritative) | |
| CVE-2026-103848 | Experience Manager | no | NVD (authoritative) | |||
| CVE-2026-105895 | Experience Manager | Critical | 9.9 | no | NVD (authoritative) | |
| CVE-2026-106626 | Experience Manager | Critical | 9.1 | no | NVD (authoritative) | |
| CVE-2026-106629 | Experience Manager | no | NVD (authoritative) | |||
| CVE-2026-106630 | Experience Manager | Critical | 9.3 | no | NVD (authoritative) | |
| CVE-2026-48382 | Experience Manager | no | NVD (authoritative) | |||
| CVE-2026-48383 | Experience Manager | no | NVD (authoritative) | |||
| CVE-2026-75732 | Experience Manager | Critical | 9.9 | no | NVD (authoritative) | |
| CVE-2026-83662 | Experience Manager | no | NVD (authoritative) | |||
| CVE-2026-90531 | Experience Manager | no | NVD (authoritative) |
CVE-2026-100133
Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability allowing attackers to inject malicious JavaScript into form fields. When a victim accesses the affected page, the script executes within the victim's session, enabling potential account takeover or unauthorized actions due to the elevated privileges or scope changes associated with the session.
Affected products:
- Adobe Commerce
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-100133
CVE-2026-103849
Adobe Commerce contains an improper neutralization of special elements vulnerability in its template engine, allowing a remote, unauthenticated attacker to achieve arbitrary code execution. The vulnerability permits attackers to gain elevated access or control over user sessions without requiring user interaction.
Affected products:
- Commerce
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-103849
Related in this roundup: CVE-2026-91013, CVE-2026-92464, CVE-2026-92909.
CVE-2026-91013
Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious JavaScript into form fields. When a victim accesses the affected page, the script executes in their browser, potentially leading to unauthorized account access or session hijacking.
Affected products:
- Commerce
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91013
Related in this roundup: CVE-2026-103849, CVE-2026-92464, CVE-2026-92909.
CVE-2026-92464
Adobe Commerce contains an improper input validation vulnerability that allows a high-privileged attacker to achieve arbitrary code execution. The vulnerability does not require user interaction and carries a high impact on the integrity and availability of the affected system.
Affected products:
- Commerce
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-92464
Related in this roundup: CVE-2026-103849, CVE-2026-91013, CVE-2026-92909.
CVE-2026-92909
CVE-2026-92909 describes an incorrect authorization vulnerability in Adobe Commerce that allows a remote, unauthenticated attacker to achieve arbitrary code execution. The flaw does not require user interaction, making it a high-severity remote code execution risk for e-commerce environments.
Affected products:
- Commerce
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-92909
Related in this roundup: CVE-2026-103849, CVE-2026-91013, CVE-2026-92464.
CVE-2026-103848
Adobe Experience Manager contains an OS command injection vulnerability, classified under CWE-78, that allows an unauthenticated or low-privileged attacker to achieve arbitrary code execution. The vulnerability does not require user interaction and impacts the scope of the affected application, posing a critical risk to environment integrity.
Affected products:
- Experience Manager
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-103848
Related in this roundup: CVE-2026-105895, CVE-2026-106626, CVE-2026-106629, CVE-2026-106630, CVE-2026-48382, CVE-2026-48383, CVE-2026-75732, CVE-2026-83662, CVE-2026-90531.
CVE-2026-105895
CVE-2026-105895 is an improper input validation vulnerability in Adobe Experience Manager that allows for unauthenticated arbitrary code execution. The vulnerability is highly critical, as it does not require user interaction and can lead to elevated access or account compromise within the context of the running application session.
Affected products:
- Experience Manager
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-105895
Related in this roundup: CVE-2026-103848, CVE-2026-106626, CVE-2026-106629, CVE-2026-106630, CVE-2026-48382, CVE-2026-48383, CVE-2026-75732, CVE-2026-83662, CVE-2026-90531.
CVE-2026-106626
Adobe Experience Manager is vulnerable to an improper input validation flaw that allows a highly privileged attacker to achieve arbitrary code execution. The vulnerability does not require user interaction and impacts the overall system security scope.
Affected products:
- Experience Manager
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-106626
Related in this roundup: CVE-2026-103848, CVE-2026-105895, CVE-2026-106629, CVE-2026-106630, CVE-2026-48382, CVE-2026-48383, CVE-2026-75732, CVE-2026-83662, CVE-2026-90531.
CVE-2026-106629
Adobe Experience Manager contains a stored cross-site scripting (XSS) vulnerability allowing remote attackers to inject malicious JavaScript into form fields. When rendered in a victim's browser, this script can execute with the context of the user session, potentially leading to unauthorized account access or session hijacking.
Affected products:
- Experience Manager
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-106629
Related in this roundup: CVE-2026-103848, CVE-2026-105895, CVE-2026-106626, CVE-2026-106630, CVE-2026-48382, CVE-2026-48383, CVE-2026-75732, CVE-2026-83662, CVE-2026-90531.
CVE-2026-106630
Adobe Experience Manager contains a stored Cross-Site Scripting (XSS) vulnerability allowing attackers to inject malicious scripts into form fields. When rendered in a victim's browser, the script executes, potentially leading to unauthorized session access or account compromise.
Affected products:
- Experience Manager
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-106630
Related in this roundup: CVE-2026-103848, CVE-2026-105895, CVE-2026-106626, CVE-2026-106629, CVE-2026-48382, CVE-2026-48383, CVE-2026-75732, CVE-2026-83662, CVE-2026-90531.
CVE-2026-48382
Adobe Experience Manager contains an incorrect authorization vulnerability that allows for remote code execution without user interaction. An unauthenticated attacker can exploit this flaw to gain unauthorized access, potentially escalating privileges within the context of the affected session.
Affected products:
- Experience Manager
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-48382
Related in this roundup: CVE-2026-103848, CVE-2026-105895, CVE-2026-106626, CVE-2026-106629, CVE-2026-106630, CVE-2026-48383, CVE-2026-75732, CVE-2026-83662, CVE-2026-90531.
CVE-2026-48383
Adobe Experience Manager contains an incorrect authorization vulnerability that allows for unauthenticated arbitrary code execution. The vulnerability is characterized by a changed scope and high severity, potentially leading to unauthorized system access or account takeover without requiring user interaction.
Affected products:
- Experience Manager
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-48383
Related in this roundup: CVE-2026-103848, CVE-2026-105895, CVE-2026-106626, CVE-2026-106629, CVE-2026-106630, CVE-2026-48382, CVE-2026-75732, CVE-2026-83662, CVE-2026-90531.
CVE-2026-75732
Adobe Experience Manager contains an incorrect authorization vulnerability that allows for unauthenticated, remote arbitrary code execution. Successful exploitation results in full control over the session or account with elevated privileges, impacting the integrity and availability of the system.
Affected products:
- Experience Manager
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75732
Related in this roundup: CVE-2026-103848, CVE-2026-105895, CVE-2026-106626, CVE-2026-106629, CVE-2026-106630, CVE-2026-48382, CVE-2026-48383, CVE-2026-83662, CVE-2026-90531.
CVE-2026-83662
Adobe Experience Manager is vulnerable to a reflected Cross-Site Scripting (XSS) attack. An attacker can exploit this by enticing a user to visit a maliciously crafted URL, allowing the injection of arbitrary scripts into the victim's session. Successful exploitation may lead to session hijacking or unauthorized actions performed on behalf of the authenticated user.
Affected products:
- Experience Manager
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-83662
Related in this roundup: CVE-2026-103848, CVE-2026-105895, CVE-2026-106626, CVE-2026-106629, CVE-2026-106630, CVE-2026-48382, CVE-2026-48383, CVE-2026-75732, CVE-2026-90531.
CVE-2026-90531
Adobe Experience Manager contains an XML External Entity (XXE) vulnerability that allows a low-privileged attacker to achieve privilege escalation and access restricted internal resources without requiring user interaction. The vulnerability significantly changes the security scope of the affected application.
Affected products:
- Experience Manager
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-90531
Related in this roundup: CVE-2026-103848, CVE-2026-105895, CVE-2026-106626, CVE-2026-106629, CVE-2026-106630, CVE-2026-48382, CVE-2026-48383, CVE-2026-75732, CVE-2026-83662.