Adobe has released its November 2026 Patch Tuesday updates, fixing roughly 110 vulnerabilities across nine products, including six Adobe Connect flaws rated the maximum CVSS score of 10.0. The updates cover Adobe Experience Manager (AEM), Audition, After Effects, Connect, the Content Credentials SDK, Dimension, Media Encoder, Photoshop and Premiere.

Six Connect flaws score the maximum 10.0

Critical-severity issues were patched in Adobe Connect and AEM. The six Connect flaws rated 10.0 span server-side request forgery, path traversal, incorrect authorisation, CRLF injection, XML external entity flaws, code injection, SQL injection and cross-site scripting. Adobe says the flaws could be exploited for privilege escalation and arbitrary code execution. In total, 38 vulnerabilities were resolved in AEM and Connect, including high- and medium-severity issues that could lead to file system reads, memory exposure and security-feature bypasses.

High-severity fixes across creative apps

High-severity bugs were also fixed in After Effects, Media Encoder, Premiere, Dimension, Audition and Photoshop, while the Content Credentials Rust SDK and the C2PA Tool received patches for roughly a dozen low- and medium-severity issues. Adobe said it is not aware of any attacks exploiting the newly patched vulnerabilities. The Connect and AEM patches carry a priority rating of 2, meaning Adobe recommends installing them soon, while the remaining updates are rated priority 3. Users should update through the Creative Cloud desktop app or Adobe's security bulletins page, and administrators should prioritise Connect and AEM first. SecurityWeek reported the release on 10 November, and Adobe's bulletins page was updated the same day.