One Adobe Patch Day. Three Ways Your Fix Can Fail.
Adobe published ten security bulletins on 13 October. The first operational question is not how many vulnerabilities landed. It is which patch path belongs to each deployed product.
Adobe says it is not aware of exploitation in the wild for the issues in its ColdFusion, Experience Manager and Commerce bulletins. That is a limit on the available evidence, not a reason to leave unauthenticated code-execution paths exposed.
ColdFusion needs application testing as well as a new build
APSB26-144 covers 32 distinct CVE identifiers in ColdFusion 2025.0.13 and 2023.0.25. The fixed destinations are 2025.0.14 and 2023.0.26.
The bulletin’s header says Priority 2, but its solution rows say Priority 1. Keep that discrepancy visible and plan against the row for the deployed branch.
The unrestricted upload flaw CVE-2026-105899 can lead to arbitrary code execution. The server-side request-forgery flaw CVE-2026-106622 can enable privilege escalation. Adobe scores both at 10.0, with neither privileges nor user interaction required.
The 2023 Update 26 notes identify twelve security changes affecting existing applications. They include authenticated WebSocket invocation, sandbox file checks and a native C++ CFX library allowlist. Administrator-package changes also matter: updating only the core does not deliver every protection. Plan a restart and representative application tests, then check the running build and required packages.
There is an important remaining boundary. Adobe’s known issue says the outbound policy checks the top-level URL fetched by cfdocument, but not sub-resource URLs in the rendered HTML. Do not treat the update as protection for every document-renderer request. Adobe advises against rendering untrusted HTML containing external resource URLs until that gap is addressed.
An AEM service-pack number is not a complete fix receipt
APSB26-152 lists 35 distinct CVE identifiers. AEM Cloud Service 2026.9.28187 and earlier moves to 2026.9.28386. AEM 6.5 Service Pack 25 and earlier, and 6.5 LTS Service Pack 3 and earlier, are affected too; the solution table specifies hotfixes for those two current service-pack bases.
The unauthenticated, network-reachable code-execution flaw CVE-2026-90532 scores 10.0. Its fix is the new cloud build or GRANITE-72352 on both on-premises lines. Other flaws have different GRANITE, SITES, CQ and NPR mappings. One hotfix therefore cannot stand in for the whole bulletin.
Build the acceptance record from the deployment model and applicable hotfix rows, not a generic “AEM updated” ticket. Then test the publishing, authoring, authentication and integration workflows that the organisation actually uses. A server that still publishes correctly has passed a functional test, not necessarily every security check.
Commerce patch order can decide whether the fix lands
APSB26-153 adds eleven distinct CVE identifiers across Adobe Commerce, B2B and Magento Open Source. Unauthenticated template injection CVE-2026-103849 can enable code execution and scores 10.0. B2B authorisation flaw CVE-2026-92909 scores 9.8 and requires no authentication.
Adobe’s October deployment guidance describes isolated files, not ordinary Composer packages. Start from the latest security-only patch release for the supported line, apply earlier monthly isolated patches in release order and match files to the installed components. For Enterprise Edition, the stated sequence puts CE before EE within each month, then B2B where applicable. Cloud users must check whether cloud-patches already supplied the fix; applying it again can fail.
The same guidance requires the separate September CVE-2026-75650 hotfix and recommends rotating encryption keys and associated credentials. Use the Commerce Version Tool, where available, to verify installed and missing patches and per-CVE protection. A download, an installer success message and a verified protected state are three different stages.
Keep the rest of the release in the inventory
Adobe’s bulletin index also lists Priority 3 updates dated 13 October for Dimension, Photoshop, FrameMaker, Substance 3D Sampler, Substance 3D Stager, Substance 3D Designer and the Content Credentials SDK. Map those products to their own update paths rather than losing them behind the server-product work.
These checks belong alongside, not inside, the Microsoft jobs in our October Patch Tuesday report. Keep separate owners and acceptance records so that success for one vendor does not become accidental clearance for another.
For each applicable system, record its installed branch, exact fix destination, test result and remaining limitation. Prioritise exposed and business-critical services, but do not close a patch ticket solely because the maintenance window has ended. The useful management number is how many applicable systems have reached a verified fixed state.
