Published 13 November 2026 · Rathish Kumar, Invitty

On 10 November 2026 Adobe published nine security bulletins. Two carry Priority 2: Adobe Connect (APSB26-191, top CVSS score 10.0) and Experience Manager (APSB26-189, top score 9.9). Photoshop, Premiere and five other apps received Priority 3 fixes. Adobe says it knows of no exploits for any of them. Patch Connect and AEM servers first, then roll the desktop updates out to Creative Cloud users.

What Adobe released on 10 November

Adobe's monthly release landed on the same day as Microsoft's Patch Tuesday, which is why it slipped past a lot of IT teams. The Zero Day Initiative's monthly review counts 110 CVEs across the nine bulletins. Here is how they line up.

Adobe bulletins, 10 November 2026Scroll to see all columns →
BulletinProductCVEsTop CVSSAdobe priority
APSB26-191Adobe Connect2410.02
APSB26-189Experience Manager149.92
APSB26-100After Effects178.63
APSB26-102Audition118.73
APSB26-181Photoshop137.83
APSB26-101Premiere117.83
APSB26-103Media Encoder67.83
APSB26-190Dimension18.23
APSB26-184Content Credentials SDK136.53

Acrobat and Reader are not on the list this month. If your only Adobe product is Acrobat, there is nothing new to push from this batch.

Connect and Experience Manager: the servers to patch first

These two matter more than the desktop apps because they sit on servers that outsiders can reach. Adobe Connect 12.12 and earlier on Windows is affected. The fixed builds are 12.12.a, 12.11.i, 12.10.f, 12.9.a and 12.8.a, so you can stay on your current branch and still be covered. The bulletin mixes SQL injection, path traversal, cross-site scripting, SSRF and XXE flaws. According to ZDI's analysis, the 10.0-rated bugs can be triggered over the network with no login and no user action.

For Experience Manager, the affected versions are AEM as a Cloud Service 2026.10.29023 and earlier, AEM 6.5 up to Service Pack 25, and AEM 6.5 LTS up to Service Pack 3. Cloud Service customers should confirm they are on 2026.10.29251 or later. On-premises 6.5 sites on SP23, SP24 or SP25, and LTS sites on SP1 to SP3, need the cumulative hotfix for GRANITE-75052. ZDI notes that the critical AEM bugs need only a low-privileged account. On a marketing site where agencies and freelancers hold author logins, that bar is low.

Which Creative Cloud apps need an update

For most of our customers the practical work is on designers' and editors' machines. Two bulletins stand out.

  • Photoshop (APSB26-181). Photoshop 2026 at 27.11 or earlier and Photoshop 2025 at 26.11.8 or earlier are affected on Windows and macOS. The fixes are Photoshop 2026 27.11.1 and Photoshop 2027 28.0. Adobe states that Photoshop 2025 will get no further update.
  • Premiere (APSB26-101). Premiere 26.5.2 and earlier, and 25.6.6 and earlier, are affected. Fixed versions are 27.0 and 26.5.3. The bulletin lists nothing for the 25.x branch.

The Photoshop 2025 line is the real news for buyers. Plenty of studios keep last year's version installed because a plugin, a colour workflow or a client template has not been tested on the new one. That habit now leaves an app with known code execution flaws on the machine for good. If you are holding a 2025 release for a plugin, test that plugin on 27.11.1 this month and retire the old version, rather than waiting for the next bulletin to force the issue.

After Effects, Audition, Media Encoder and Dimension follow the same pattern: update through the Creative Cloud desktop app, or, if your admins build managed packages in the Adobe Admin Console, rebuild the package with the current versions so new installs do not reintroduce the old builds.

A rollout order that works for small design teams

  1. Find your servers. Check whether anyone in the company runs Adobe Connect or an on-premises AEM instance. Agencies sometimes host these for you, so ask them for the build number in writing.
  2. Patch Connect and AEM to the fixed builds above, during a short window, and take a backup first.
  3. List desktop versions. The Admin Console shows who holds which product; the Creative Cloud app on each machine shows installed versions.
  4. Update Photoshop and Premiere on the machines that handle files from outside, such as client artwork, downloaded stock and email attachments, before the rest.
  5. Remove Photoshop 2025 once the replacement is tested.

What it means for Adobe renewals in India

Security updates are only useful if the seat is licensed and signed in. When we audit design teams we often find a mix of team seats, individual plans bought on a personal card, and one or two machines nobody can account for. Those last ones are usually the ones still on Photoshop 2025. Bringing every user under one Creative Cloud for teams or enterprise agreement gives you a single Admin Console view and one GST invoice for the finance team. If your renewal falls in the next few months, it is a good moment to tidy this up; our renewals desk can line up the dates. For AEM or Connect servers that show signs of misuse, CERT-In's six-hour reporting rule for certain incidents applies, so have the escalation path agreed in advance.

Questions we are hearing about the November Adobe bulletins

Are any of the November Adobe flaws being exploited?
No. Each of the bulletins we checked, including Connect, Experience Manager, Photoshop and Premiere, says Adobe is not aware of exploits in the wild. The Connect and AEM flaws are rated Priority 2, so we still treat them as this month's first job.
We still use Photoshop 2025. Do we have to move?
Yes, if you want security fixes. Adobe says Photoshop 2025 will receive no further update for these issues and points users to Photoshop 2026 27.11.1 or Photoshop 2027 28.0. Test any plugins you depend on, then remove the 2025 install.
We use AEM as a Cloud Service. Is there anything to do?
Confirm that your environment is on 2026.10.29251 or later, which is the fixed release Adobe lists. On-premises AEM 6.5 and 6.5 LTS sites need the cumulative hotfix for GRANITE-75052 instead.
Is Acrobat or Reader part of this release?
No. The nine November bulletins cover Connect, Experience Manager, After Effects, Audition, Photoshop, Premiere, Media Encoder, Dimension and the Content Credentials SDK. Keep Acrobat on its normal update schedule.

Next step

Send us your Adobe Admin Console seat list, or simply the number of designers and the versions they run, and tell us whether you host Connect or AEM. We will point out which machines and servers are below the fixed builds, and quote any seat changes or renewals with a GST invoice. Licensing options are on our Adobe page, and more on what we supply is on the Adobe brand page.

Sources

Facts in this post come from these pages, checked on the date of publication. Advisories and release notes change, so check the source before you schedule work.