Adobe releases September 2026 patches for multiple products Adobe's September 2026 security updates patch vulnerabilities across eight produ

Adobe's September 2026 release patched roughly 140 vulnerabilities across ten advisories, but the urgent item landed a day earlier. CVE-2026-75650 is an unauthenticated remote code execution flaw in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, named StyleSmuggler by Sansec, whose forensics team published research on September 5 after finding exploited stores. Adobe shipped Hotfix VULN-39341 on September 7, and Tenable's Research Special Operations team confirmed exploitation began September 4, three days before any fix existed, with victims confirmed across multiple campaigns. The batch itself carries 32 ColdFusion fixes including critical code execution and privilege escalation bugs, 30 in the Content Credentials SDK, 18 in Photoshop and 16 in Substance 3D Stager dominated by arbitrary code execution, and 11 in Commerce. Adobe reports no exploitation of the batch and rates every product priority 3 except Commerce, the only priority 2.

The batch advisory's no-known-exploitation line is the weakest signal in this release. Commerce carries priority 2 precisely because attackers have historically targeted it, and it was under active zero-day attack while the September cycle was being assembled, so the honest reading is that this product line was a proven target before the advisory existed. Unauthenticated RCE on a commerce platform means store takeover: payment skimming, order and price manipulation, and a foothold for reaching back-office systems, and multiple victims across distinct campaigns point to repeatable tradecraft rather than a single targeted breach. The support window makes it worse. Adobe patched supported versions only, and Magento Open Source stores below 2.4.6 received nothing, so a long tail of installations has no patch path at all and stays exposed regardless of how diligently operators apply the September batch.

Commerce and Magento operators should first verify the VULN-39341 hotfix or the September Commerce rollup is actually installed, then confirm the version sits inside the supported window, because below 2.4.6 on Magento Open Source the only remediation is upgrade or isolate. Tenable's detection plugins for CVE-2026-75650 were still rolling out at disclosure, so until scanner coverage lands, hunt directly on any Commerce host with an internet-facing checkout: the flaw is triggerable without authentication, so review admin accounts, scheduled tasks, and unexplained files in web roots. Campaign Classic sites have their own emergency in the same cycle: a CVSS 10.0 unauthenticated command injection fixed in build 9402, tracked as TL-2026-2408 with five published IOCs. ColdFusion's 32 fixes include critical RCE and privilege escalation and deserve patch-first treatment. The Photoshop, Substance 3D, FrameMaker, Dimension, Bridge, and Content Credentials SDK fixes can follow the normal cycle, though the code execution density matters wherever staff open untrusted documents.

Two developments would change this assessment. Widespread scanning or skimmer campaigns against the unpatchable pre-2.4.6 Magento installed base would confirm the long-tail risk and could force Adobe into out-of-band fixes for versions it no longer supports. And any exploitation telemetry against the ColdFusion fixes or the Campaign Classic injection would collapse the priority 3 stance for the rest of the batch, turning a large but routine patch cycle into an emergency for every shop running those products.