Adobe patches 110 flaws across nine products in November

Adobe has released patches addressing about 110 vulnerabilities across nine products in its November 2026 Patch Tuesday cycle, covering Adobe Experience Manager (AEM), Audition, After Effects, Connect, Content Credentials SDK, Dimension, Media Encoder, Photoshop, and Premiere. The company notes critical-severity fixes in both Connect and AEM, including six flaws in Connect rated at CVSS v3.1 10.0.

The issues span a range of impact types—SSRF, path traversal, incorrect authorisation, CRLF injection, XXE, code injection, SQL injection, and XSS—with potential paths to privilege escalation and arbitrary code execution.

Security Week reports a total of 38 vulnerabilities resolved specifically in AEM and Connect, encompassing high- and medium-severity flaws whose exploitation could lead to privilege escalation, file system read access, memory exposure, arbitrary code execution, and bypassing security features. High-severity bugs were patched in After Effects, Media Encoder, Premiere, Dimension, Audition, and Photoshop.

The Content Credentials Rust SDK (and the C2PA Tool) received patches for roughly a dozen low- to medium-severity issues. Adobe says it is not aware of active exploits targeting the newly patched vulnerabilities. The publication notes a priority rating of 2 for Connect and AEM patches, with 3 for the remainder, indicating these flaws are unlikely to be exploited in the wild.