THE October 2026 security update cycle sees Adobe patching across 11 bulletins addressing 174 CVEs spanning Dimension, Commerce, Substance 3D, Bridge and related tools, with several critical issues. Notably, Adobe ColdFusion (APSB26-144) contains 32 critical CVEs (CVSS 10.0) including unrestricted file upload, code injection, SSRF and improper authorisation, described as a pre-auth RCE profile on internet-facing servers.
Adobe Experience Manager (APSB26-152) also carries 33 critical CVEs, while Commerce (APSB26-153) has 11 critical CVEs and a recent history of actively exploited flaws in this space. The Experience Manager, Commerce and ColdFusion updates are prioritised as Priority 2, with the rest of the Adobe patches at Priority 3. The guidance notes no Adobe patches are listed as publicly exploited at the time of release, beyond the ColdFusion and related triage considerations.
The article also recounts Microsoft’s change of approach, introducing “risk cohorts” to help organisations triage updates, while emphasising that these cohorts do not replace CVE-by-CVE analysis.
Microsoft’s October 2026 release is described as a new record in terms of volume, with an estimated 1,415 new CVEs across Windows, Office, Developer Tools, .NET, SharePoint, SQL Server, Dynamics, Azure and Exchange, among others. The author highlights that only one of these is listed as under active attack, noting a broader trend where wormable bugs are numerous this month (the article counts 59 wormable CVEs).
Key publicly known items include CVE-2026-96951 (Windows Shell Security Feature Bypass) listed as under active attack, and CVE-2026-102866 (SharePoint Elevation of Privilege) and CVE-2026-65674 (SQL Server RCE) among Critical issues. The article provides an extensive list of CVEs and technical details, urging prompt testing and deployment of fixes for the most severe and exploitable bugs, while cautioning against relying on CVE counts alone for prioritisation. The piece ends with a full and long CVE list, reiterating the scale and the need for timely action.