Security Digest: September 13, 2026 - 17 Critical Vulnerabilities

Today’s alerts include multiple remote code execution and privilege escalation flaws across Adobe Experience Manager, ColdFusion, Adobe Commerce, Android components, font rendering libraries, and Skype for Business. Several issues require no user interaction, which means exposed systems may be at risk right now.

· 14 min read

Urgent Security Digest: 17 Critical Vulnerabilities Demand Immediate Action

Executive Summary

Today’s alerts include multiple remote code execution and privilege escalation flaws across Adobe Experience Manager, ColdFusion, Adobe Commerce, Android components, font rendering libraries, and Skype for Business. Several issues require no user interaction, which means exposed systems may be at risk right now.

Priority one: patch internet-facing Adobe products immediately, then move to mobile/endpoint and collaboration platform fixes. If you cannot patch today, isolate affected services, restrict access, and increase monitoring for suspicious admin activity, web shells, and unusual authentication events.

Critical Vulnerabilities

  • CVE-2026-19232: Adobe Experience Manager incorrect authorization leading to code execution
    • Impact: A low-privileged attacker may gain elevated access or control of a victim account/session and potentially execute code in the user context.
    • Affected Systems: Adobe Experience Manager
    • Immediate Action: Patch Adobe Experience Manager now; prioritize any internet-facing or externally reachable deployment.
    • Mitigation: Apply the vendor fix, restrict admin access, and review session/authentication logs for abuse.
  • CVE-2026-48273: Adobe ColdFusion eval injection
    • Impact: Remote code execution in the context of the current user.
    • Affected Systems: Adobe ColdFusion
    • Immediate Action: Patch immediately and remove public exposure until updated.
    • Mitigation: Install the official ColdFusion update and confirm no untrusted input reaches dynamic evaluation paths.
  • CVE-2026-76200: Adobe Commerce stored XSS
    • Impact: Attackers can inject scripts that run in a victim’s browser and hijack sessions or actions.
    • Affected Systems: Adobe Commerce, Adobe Commerce B2B, Adobe Magento
    • Immediate Action: Patch storefront and admin instances now; review form fields and content entry points.
    • Mitigation: Apply the vendor update, sanitize user content, and enforce strict output encoding.
  • CVE-2026-76201: Adobe Commerce stored XSS
    • Impact: Same risk as above: session theft, account takeover, and malicious admin actions.
    • Affected Systems: Adobe Commerce, Adobe Commerce B2B, Adobe Magento
    • Immediate Action: Patch immediately and audit any recently submitted content.
    • Mitigation: Deploy the vendor fix and check for suspicious script payloads in stored fields.
  • CVE-2026-49882: Heap buffer overflow in rw_mfc_handle_read_op
    • Impact: Possible remote code execution with no extra privileges and no user interaction.
    • Affected Systems: Affected product using rw_mfc.cc component
    • Immediate Action: Update the affected software package or remove the vulnerable component from exposed systems.
    • Mitigation: Apply the upstream patch and block untrusted inputs until fixed.
  • CVE-2026-49879: Integer overflow in rw_t3t.cc out-of-bounds write
    • Impact: Possible remote code execution without user interaction.
    • Affected Systems: Affected product using rw_t3t.cc component
    • Immediate Action: Patch now; treat any exposed service using this library as high risk.
    • Mitigation: Install the vendor fix and validate that the component is not directly reachable.
  • CVE-2026-77111: Adobe Commerce authorization bypass
    • Impact: High-privilege attacker can bypass security controls and gain unauthorized write access.
    • Affected Systems: Adobe Commerce, Adobe Commerce B2B, Adobe Magento
    • Immediate Action: Patch admin systems immediately and review privileged accounts for misuse.
    • Mitigation: Apply the update, tighten admin roles, and rotate credentials if abuse is suspected.
  • CVE-2026-77109: Adobe Commerce privilege escalation
    • Impact: Attackers may gain elevated access to restricted resources.
    • Affected Systems: Adobe Commerce, Adobe Commerce B2B, Adobe Magento
    • Immediate Action: Patch immediately and check for unexpected privilege changes.
    • Mitigation: Deploy the vendor fix and enforce least privilege for all commerce admins.
  • CVE-2026-77774: Adobe Commerce security bypass
    • Impact: Unauthorized read access to protected data.
    • Affected Systems: Adobe Commerce, Adobe Commerce B2B, Adobe Magento
    • Immediate Action: Patch and audit access to sensitive catalog, order, and customer data.
    • Mitigation: Apply the update and verify access controls on restricted endpoints.
  • CVE-2026-76202: Adobe Commerce privilege escalation
    • Impact: Elevated access to sensitive information.
    • Affected Systems: Adobe Commerce, Adobe Commerce B2B, Adobe Magento
    • Immediate Action: Patch now and review logs for unusual reads of sensitive records.
    • Mitigation: Install the vendor patch and restrict who can view sensitive admin data.
  • CVE-2026-58874: Missing permission check in SmsController.java
    • Impact: Local attackers may gain elevated privileges on affected Android-based systems.
    • Affected Systems: Affected Android component using SmsController.java
    • Immediate Action: Push the security update to managed devices immediately.
    • Mitigation: Apply the platform patch and limit untrusted app installation.
  • CVE-2026-49919: Integer overflow in tt_face_colr_blend_layer
    • Impact: Possible code execution triggered by malicious font data.
    • Affected Systems: Affected font rendering component using ttcolr.c
    • Immediate Action: Patch libraries and browsers/renderers that bundle the vulnerable code.
    • Mitigation: Update the affected package and block untrusted font content where possible.
  • CVE-2026-49881: Logic error in serviceClassExists
    • Impact: Local escalation of privilege and potential arbitrary code execution.
    • Affected Systems: Affected Android component using InCallController.java
    • Immediate Action: Deploy the latest Android security patch to all supported devices.
    • Mitigation: Apply the fix and review device management policies for sideloading and app trust.
  • CVE-2026-77110: Adobe Commerce path traversal
    • Impact: Unauthorized file or directory access outside intended restrictions.
    • Affected Systems: Adobe Commerce, Adobe Commerce B2B, Adobe Magento
    • Immediate Action: Patch immediately and inspect for suspicious file access attempts.
    • Mitigation: Apply the vendor update and restrict filesystem permissions on the application host.
  • CVE-2026-77108: Adobe Commerce privilege escalation
    • Impact: Elevated access to sensitive information.
    • Affected Systems: Adobe Commerce, Adobe Commerce B2B, Adobe Magento
    • Immediate Action: Patch and verify that admin and service accounts are correctly scoped.
    • Mitigation: Install the update and rotate credentials for high-value accounts if needed.
  • CVE-2026-45528: Unsafe PendingIntent chain in StorageManagerService
    • Impact: Local privilege escalation after user interaction.
    • Affected Systems: Affected Android builds containing StorageManagerService.java
    • Immediate Action: Update devices; warn users not to approve unexpected prompts.
    • Mitigation: Apply the patch and tighten mobile app permissions and device policy controls.
  • CVE-2026-66305: Skype for Business client-side authentication spoofing
    • Impact: An authorized attacker may spoof identity over the network.
    • Affected Systems: Skype for Business
    • Immediate Action: Review exposure and apply any available Microsoft update or guidance immediately.
    • Mitigation: Patch, restrict network trust boundaries, and monitor for anomalous authentication patterns.

Previously Alerted

What to Do Now

  1. Patch Adobe products first: Experience Manager, ColdFusion, and all Adobe Commerce/Magento instances.
  2. Update Android and embedded/mobile components: push the latest security patches to managed devices and bundled libraries.
  3. Check exposure: remove public access where possible, especially for admin panels and collaboration services.
  4. Hunt for abuse: review logs for unusual logins, privilege changes, script injection, and file access anomalies.
  5. Contain if you cannot patch today: restrict network access, disable vulnerable features, and isolate affected systems.

Verification steps: confirm installed build numbers against vendor advisories, validate that patched services restart cleanly, and scan for indicators of compromise on any externally reachable host. For Adobe Commerce and AEM, inspect recent admin actions, new users, template changes, and unexpected outbound connections.

Monitoring recommendations: alert on new privileged accounts, unusual session reuse, suspicious POSTs to admin endpoints, web shell patterns, and repeated authentication failures. For mobile fleets, watch for devices that miss the latest security patch level.

Related Resources

  • Internal blog posts: upcoming guidance on emergency patch triage, Adobe exposure hardening, and mobile fleet verification.
  • Official vendor advisories: Adobe Security Bulletins, Microsoft Security Update Guide, Android Security Bulletins, and the relevant component maintainer advisories.

Keep reading