{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aadobecommerce/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.4:p10:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.4:p11:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.4:p12:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.4:p13:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.4:p14:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.4:p15:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.4:p16:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.4:p17:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.4:p18:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.4:p7:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.4:p8:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.4:p9:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2026-75650"},{"cvss":9.3,"id":"CVE-2026-76201"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["roundup"],"_cs_type":"threat","_cs_vendors":["Adobe"],"content_html":"\u003cp\u003eThis roundup covers 7 Adobe security vulnerabilities. All have a CVSS base score of 10.0. None are reported as actively exploited at the time of release. The issues affect Adobe Commerce, Campaign Classic, ColdFusion, Commerce, Experience Manager, Substance 3D Sampler.\u003c/p\u003e\n\u003ch2 id=\"summary\"\u003eSummary\u003c/h2\u003e\n\u003ctable\u003e\n\t\u003cthead\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003cth\u003eCVE\u003c/th\u003e\n\t\t\t\t\t\u003cth\u003eProduct\u003c/th\u003e\n\t\t\t\t\t\u003cth\u003eSeverity\u003c/th\u003e\n\t\t\t\t\t\u003cth\u003eCVSS\u003c/th\u003e\n\t\t\t\t\t\u003cth\u003eEPSS\u003c/th\u003e\n\t\t\t\t\t\u003cth\u003eKEV\u003c/th\u003e\n\t\t\t\t\t\u003cth\u003eSource\u003c/th\u003e\n\t\t\t\u003c/tr\u003e\n\t\u003c/thead\u003e\n\t\u003ctbody\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003e\u003ca href=\"#cve-2026-83959\"\u003eCVE-2026-83959\u003c/a\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eSubstance 3D Sampler\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eno\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-83959\"\u003eNVD\u003c/a\u003e (authoritative)\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003e\u003ca href=\"#cve-2026-75650\"\u003eCVE-2026-75650\u003c/a\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eAdobe Commerce\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eCritical\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e10.0\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e0.68%\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eno\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-75650\"\u003eNVD\u003c/a\u003e (authoritative)\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003e\u003ca href=\"#cve-2026-76200\"\u003eCVE-2026-76200\u003c/a\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eCommerce\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eno\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-76200\"\u003eNVD\u003c/a\u003e (authoritative)\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003e\u003ca href=\"#cve-2026-76201\"\u003eCVE-2026-76201\u003c/a\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eCommerce\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eno\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-76201\"\u003eNVD\u003c/a\u003e (authoritative)\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003e\u003ca href=\"#cve-2026-82004\"\u003eCVE-2026-82004\u003c/a\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eCampaign Classic\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eno\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-82004\"\u003eNVD\u003c/a\u003e (authoritative)\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003e\u003ca href=\"#cve-2026-19232\"\u003eCVE-2026-19232\u003c/a\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eExperience Manager\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eno\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-19232\"\u003eNVD\u003c/a\u003e (authoritative)\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003e\u003ca href=\"#cve-2026-48273\"\u003eCVE-2026-48273\u003c/a\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eColdFusion\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eno\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e\u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-48273\"\u003eNVD\u003c/a\u003e (authoritative)\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\u003c/tbody\u003e\n\u003c/table\u003e\n\u003ch2 id=\"cve-2026-83959\"\u003eCVE-2026-83959\u003c/h2\u003e\n\u003cp\u003eAdobe Substance 3D Sampler contains a heap-based buffer overflow vulnerability triggered by opening a malicious file. Successful exploitation allows an attacker to achieve arbitrary code execution in the context of the current user, requiring user interaction to open the crafted file.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eSubstance 3D Sampler\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-83959\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2026-83959\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-75650\"\u003eCVE-2026-75650\u003c/h2\u003e\n\u003cp\u003eAdobe Commerce contains a vulnerability involving improper neutralization of special elements used in a template engine, which allows an unauthenticated attacker to execute arbitrary code. The vulnerability is categorized as remote code execution, does not require user interaction, and impacts the integrity and availability of the system.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdobe Commerce\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-75650\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2026-75650\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-76200\"\u003eCVE-2026-76200\u003c/h2\u003e\n\u003cp\u003eAdobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability allowing attackers to inject malicious JavaScript into form fields. When a victim accesses the affected page, the script executes within the victim's session, potentially leading to unauthorized account access or session hijacking.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCommerce\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-76200\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2026-76200\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eRelated in this roundup: \u003ca href=\"#cve-2026-76201\"\u003eCVE-2026-76201\u003c/a\u003e.\u003c/p\u003e\n\u003ch2 id=\"cve-2026-76201\"\u003eCVE-2026-76201\u003c/h2\u003e\n\u003cp\u003eAdobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability allowing an attacker to inject malicious scripts into form fields. When a victim accesses the affected page, the script executes in their browser, potentially leading to session hijacking or unauthorized account access.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCommerce\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-76201\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2026-76201\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eRelated in this roundup: \u003ca href=\"#cve-2026-76200\"\u003eCVE-2026-76200\u003c/a\u003e.\u003c/p\u003e\n\u003ch2 id=\"cve-2026-82004\"\u003eCVE-2026-82004\u003c/h2\u003e\n\u003cp\u003eAdobe Campaign Classic (ACC) is vulnerable to an OS command injection flaw (CVE-2026-82004) that allows unauthenticated attackers to achieve remote code execution in the context of the current user without requiring user interaction. The vulnerability has a CVSS v3.1 base score of 10.0 and involves a changed scope, indicating potential impact beyond the affected service.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCampaign Classic\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-82004\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2026-82004\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-19232\"\u003eCVE-2026-19232\u003c/h2\u003e\n\u003cp\u003eAdobe Experience Manager is vulnerable to an incorrect authorization flaw that allows a low-privileged attacker to achieve arbitrary code execution. The vulnerability does not require user interaction and can result in the attacker gaining elevated access or control over a victim's session, leading to a full compromise of the affected account scope.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eExperience Manager\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-19232\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2026-19232\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-48273\"\u003eCVE-2026-48273\u003c/h2\u003e\n\u003cp\u003eAdobe ColdFusion is vulnerable to an improper neutralization of directives in dynamically evaluated code (Eval Injection), which allows a low-privileged attacker to achieve remote code execution without user interaction. The vulnerability results in a change of scope, significantly increasing the impact of successful exploitation.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eColdFusion\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-48273\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2026-48273\u003c/a\u003e\u003c/p\u003e\n","date_modified":"2026-09-08T22:21:15Z","date_published":"2026-09-03T19:22:39Z","id":"https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/","summary":"Roundup of Adobe security advisories published in September 2026.","title":"Adobe Security Updates - September 2026","url":"https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}