MeridianMeridian

Adobe Patches 110 Vulnerabilities Across Nine Products in November 2026 Update

Adobe has released its November 2026 Patch Tuesday updates that address roughly 110 vulnerabilities spread across nine products. The affected applications include Adobe Experience Manager, Audition, After Effects, Connect, Content Credentials SDK, Dimension, Media Encoder, Photoshop, and Premiere. Critical-severity flaws with CVSS scores reaching 10 were fixed in Adobe Connect and AEM, covering issues such as SSRF, path traversal, XXE, SQL injection, and XSS that could enable privilege escalation and arbitrary code execution. A total of 38 vulnerabilities were resolved in AEM and Connect alone, including high- and medium-severity bugs leading to file system access and security bypasses. High-severity issues were also addressed in After Effects, Media Encoder, Premiere, Dimension, Audition, and Photoshop. The Content Credentials Rust SDK and C2PA Tool received fixes for about a dozen lower-severity problems. Adobe states it is unaware of any active exploitation of the newly patched flaws, with Connect and AEM updates carrying priority rating 2 while the remainder are rated 3.

SecurityWeekTranslated from English

Read at source

Adobe has issued its November 2026 Patch Tuesday updates, resolving approximately 110 vulnerabilities across nine products. The patches cover Adobe Experience Manager (AEM), Audition, After Effects, Connect, Content Credentials SDK, Dimension, Media Encoder, Photoshop, and Premiere.

Critical-severity issues were addressed in Adobe Connect and AEM, including six Adobe Connect flaws carrying a CVSS score of 10. These critical vulnerabilities encompass SSRF, path traversal, incorrect authorization, CRLF injection, XXE, code injection, SQL injection, and XSS weaknesses that could be exploited for privilege escalation and arbitrary code execution.

In total, 38 vulnerabilities were fixed in AEM and Connect, encompassing high- and medium-severity issues whose exploitation could result in privilege escalation, file system read access, memory exposure, arbitrary code execution, and bypassing of security features.

High-severity bugs were also resolved in After Effects, Media Encoder, Premiere, Dimension, Audition, and Photoshop. The Content Credentials Rust SDK and the C2PA Tool received patches for roughly a dozen low- and medium-severity issues.

Adobe reports it is not aware of any attacks exploiting the newly patched vulnerabilities. The Connect and AEM patches carry a priority rating of 2, while the remaining updates are rated 3, indicating they are unlikely to be exploited in the wild.

Adobe Experience ManagerAdobe ConnectContent Credentials SDKC2PA ToolAfter EffectsMedia Encoder
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

SGLang RCE Exploit Breaches NEAR AI Inference Servers, Exposing Data from 18 Agents and 100 Users
Vulns & Exploits

SGLang RCE Exploit Breaches NEAR AI Inference Servers, Exposing Data from 18 Agents and 100 Users

An attacker exploited a remote code execution vulnerability in SGLang, an open-source inference engine, to compromise one of NEAR AI's inference servers last Sunday. The intrusion allowed access to requests processed that day, including those handled in confidential mode inside a trusted execution environment. Although the TEE was intended to protect privacy, the flaw in SGLang running inside it enabled the attacker to reach sensitive data. The intruder then moved laterally to an internal system behind the deprecated Private Chat product, downloading account details for roughly 100 users. Eighteen AI agents on an older NEAR AI Agents deployment outside the TEE were also compromised, resulting in the theft of chat histories, settings, and logs. Two NEAR AI Cloud API keys were exposed in logs and subsequently revoked. NEAR AI has since revoked sessions, replaced tokens, deployed a SGLang fix across servers, and completed forensic review while notifying affected users.

The Hacker NewsNov 10, 2026Translated from English

Git Patches Integer Truncation Flaw CVE-2026-111760 Enabling Code Execution via Malicious Submodules in Recursive Clones
Vulns & Exploits

Git Patches Integer Truncation Flaw CVE-2026-111760 Enabling Code Execution via Malicious Submodules in Recursive Clones

The Git project has released fixes for CVE-2026-111760, an integer truncation vulnerability in Git's index handling that allows a malicious repository to execute attacker-controlled code during recursive clones involving submodules. The flaw affects multiple Git versions and was addressed in Git 2.56.1 along with backported updates for the 2.50 through 2.55 series. An extremely long path can bypass safety checks and be truncated to target a .git file, which Git treats as a symlink in freshly cloned submodules, enabling malicious hooks to run. GitHub has applied the fixes to its platform and recommends immediate updates, while also detailing five additional vulnerabilities resolved in the same releases. GitLab highlighted risks to code-hosting servers through commands like git merge-tree. Workarounds include avoiding untrusted recursive clones and sources until patches are installed.

The Hacker NewsNov 10, 2026Translated from English

Microsoft Patches 1,094 Vulnerabilities Including Exploited Outlook Zero-Day CVE-2026-124194
Vulns & Exploits

Microsoft Patches 1,094 Vulnerabilities Including Exploited Outlook Zero-Day CVE-2026-124194

Microsoft’s November 2026 Patch Tuesday release addresses a total of 1,094 vulnerabilities across its product portfolio. Among them is CVE-2026-124194, an Outlook spoofing zero-day that has already been exploited in the wild. The flaw allows an attacker to send a specially crafted message file that tricks users into opening it, causing Outlook to connect to an attacker-controlled server and disclose NTLMv2 hashes without showing the usual external-content warning. Microsoft rates the issue as moderate with a CVSS score of 6.5 and confirms it cannot be triggered through the Preview Pane. The update also covers 726 Windows flaws, 174 Office issues, and dozens more in SQL Server, SharePoint, Azure, and Exchange Server. This release marks the final monthly security updates for Windows 11 version 23H2 Enterprise and Education editions.

SecurityWeekNov 10, 2026Translated from English