Adobe Patches 110 Vulnerabilities Across 9 Products

Entenda a falha

A vulnerabilidade

Adobe's November 2026 Patch Tuesday fixes roughly 110 vulnerabilities in nine products: Experience Manager (AEM), Audition, After Effects, Connect, Content Credentials SDK, Dimension, Media Encoder, Photoshop and Premiere. The most severe are critical flaws in Connect and AEM, including six Connect bugs with a CVSS score of 10. The classes include SSRF, path traversal, incorrect authorization, CRLF injection, XXE, code injection, SQL injection and XSS, and they can lead to privilege escalation and arbitrary code execution. Other AEM and Connect bugs (38 in total across the two) can cause file system read, memory exposure and security feature bypass. High-severity bugs were fixed in After Effects, Media Encoder, Premiere, Dimension, Audition and Photoshop, and about a dozen low- and medium-severity issues in the Content Credentials Rust SDK and C2PA Tool. The articles give no CVE IDs or version numbers.

Por que é vulnerável

The articles do not describe root causes for individual bugs. The classes named point to missing or wrong authorization checks and to input that is not validated or neutralized before use, such as in requests, queries, XML parsing and page output. The fixes are Adobe's updates for each product.

Como foi descoberta

The flaws were disclosed through Adobe's regular November 2026 Patch Tuesday updates. The articles do not say who found them or how. Adobe says it is not aware of attacks exploiting the newly patched vulnerabilities. The Connect and AEM patches have a priority rating of 2, and the rest are rated 3, meaning exploitation in the wild is considered unlikely.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 17:15.