Adobe has fixed roughly 110 security vulnerabilities across nine products in its November 2026 Patch Tuesday updates, published on Tuesday 10 November 2026.

New patches are available for Adobe Experience Manager (AEM), Audition, After Effects, Connect, Content Credentials SDK, Dimension, Media Encoder, Photoshop and Premiere. Adobe says it is not aware of attacks exploiting any of the newly patched vulnerabilities.

Six Connect flaws score the maximum 10.0

The most serious issues are in Adobe Connect and Adobe Experience Manager. Six flaws in Connect carry a CVSS score of 10.0, the maximum rating, and critical-severity issues have also been patched in AEM.

The critical flaws include server-side request forgery, path traversal, incorrect authorisation, CRLF injection, XML external entity (XXE) flaws, code injection, SQL injection and cross-site scripting. They can be exploited for privilege escalation and arbitrary code execution.

A total of 38 vulnerabilities have been fixed in AEM and Connect, including high- and medium-severity issues that could lead to privilege escalation, file system reads, memory exposure, arbitrary code execution and bypassing security features.

Creative apps also patched

High-severity bugs have been fixed in After Effects, Media Encoder, Premiere, Dimension, Audition and Photoshop. The Content Credentials Rust SDK and the C2PA Tool received patches for roughly a dozen low- and medium-severity issues.

Adobe has given the Connect and AEM patches a priority rating of 2, which means it expects them to be targeted sooner than the rest. The remaining patches are rated priority 3, meaning Adobe considers them unlikely to be exploited in the wild.

What to do now

Organisations running Adobe Connect or Experience Manager should apply those updates first, starting with internet-facing systems, and then work through the Creative Cloud application updates in their normal patch cycle.

Adobe publishes its security bulletins on its Trust Center page, where administrators can check the full list of fixed vulnerabilities and the versions that carry the patches. Keeping creative and collaboration tools up to date matters: Connect and AEM are widely used in enterprises and education, and the maximum-severity flaws in this release need no user interaction to be useful to an attacker once a vulnerable system is reachable.

The November round continues a busy year for Adobe patches. Its October bulletins included 31 ColdFusion fixes, ten of them rated Critical. The pattern is the same each time: the headline count is large, but the urgent work is a short list of critical flaws in internet-facing products, led this month by Connect and Experience Manager.