Adobe fixes CVSS 10 flaws in ColdFusion and Experience Manager

Adobe fixes CVSS 10 flaws in ColdFusion and Experience Manager

13 October 2026: Adobe's October bulletins fix 32 vulnerabilities in ColdFusion, ten of them critical, and 35 in Adobe Experience Manager, fourteen of them critical, with the worst in each product scored 10.0. In ColdFusion an unrestricted file upload, CVE-2026-105899, can lead to arbitrary code execution; in Experience Manager three incorrect-authorization flaws, CVE-2026-90532, CVE-2026-48383 and CVE-2026-48382, do the same. Adobe says it is not aware of any exploits in the wild for either bulletin.

ColdFusion: update to 2025.0.14 or 2023.0.26

Bulletin APSB26-144 covers ColdFusion 2025 up to Update 13 and ColdFusion 2023 up to Update 25 on all platforms. The fixed releases are ColdFusion 2025 Update 14 and ColdFusion 2023 Update 26. Adobe gives the bulletin a priority of 2 but rates installing the fixed versions as priority 1, its most urgent level.

Besides the file upload flaw, the critical list includes a server-side request forgery, CVE-2026-106622, also scored 10.0, which Adobe says can lead to privilege escalation; a code injection flaw, CVE-2026-105903, and an incorrect-authorization flaw, CVE-2026-106612, both scored 9.9; and an input validation flaw, CVE-2026-106624, at 9.8. The other 21 are rated high and one medium.

Adobe's advice goes beyond the patch. It asks administrators to update the ColdFusion JDK or JRE to the latest long-term support release, use the latest MySQL Java connector, review its serial filter settings against insecure deserialization, and apply the ColdFusion lockdown guide for their version. ColdFusion servers have repeatedly been attacked within weeks of past patch days, so internet-facing ones are the place to start.

Experience Manager: cloud fixed, on-premises needs hotfixes

Bulletin APSB26-152 covers AEM as a Cloud Service release 2026.9.28187 and earlier, AEM 6.5 up to Service Pack 25 and AEM 6.5 LTS up to Service Pack 3. Cloud Service is fixed in release 2026.9.28386, which Adobe rolls out itself.

On-premises and managed-services customers have more work. There is no new service pack: AEM 6.5 Service Pack 25 and 6.5 LTS Service Pack 3 need a list of individual hotfixes, among them GRANITE-72352, GRANITE-71772, GRANITE-75052 and GRANITE-71379, plus SITES and NPR packages that differ between the two lines. Teams should check each hotfix against their exact version rather than assume one package covers everything.

Eleven of the AEM flaws score 9.0 or higher. After the three at 10.0 come an input validation flaw, CVE-2026-105895, an OS command injection, CVE-2026-103848, and another incorrect-authorization flaw, CVE-2026-75732, all at 9.9, then an XML external entity flaw and three cross-site scripting flaws that Adobe says can lead to privilege escalation. The remaining 21 are medium-rated cross-site scripting issues.

Adobe in our catalogue

We list Adobe as a company and Adobe Experience Manager among its products.

Related on TrustList:

• Apache HTTP Server 2.4.69 fixes 23 vulnerabilities, including memory-safety flaws in mod_http2 and mod_dav: update web servers
• SharePoint Server CVE-2026-65660 and WordPress CVE-2026-87902 are now exploited: check the August SharePoint update and WordPress 7.1.2
• Next.js flaw in next/og ImageResponse allows remote code execution: upgrade to 16.3.6

Sources

• Adobe: Security update available for Adobe ColdFusion, APSB26-144, 13 October 2026
• Adobe: Security update available for Adobe Experience Manager, APSB26-152, 13 October 2026