Summary
- Adobe Commerce bulletin APSB26-153 was updated on 13 October.
- Adobe recommends an additional hotfix for CVE-2026-75650 and rotation of encryption keys.
- Affected versions and remedies differ across the company’s product lines.
Adobe has issued new security updates for enterprise software as part of its October 2026 patch cycle, including remediation for Adobe Commerce and Magento Open Source. An Adobe Commerce notice updated on 13 October identifies a critical update, APSB26-153, and instructs customers to apply a separate hotfix for CVE-2026-75650 alongside the October isolated patch.
Adobe also strongly recommends rotating encryption keys and associated credentials as part of remediation for the Commerce issue. The instruction is more extensive than simply installing a routine application update and reflects the sensitivity of secrets that support commercial transactions and integrations. The company warns that unpatched systems remain exposed to the issues addressed in the bulletin.
Commerce platforms are often connected to payment providers, customer accounts, inventory systems, fulfilment services and extensions maintained by third parties. Their exposure cannot be determined from the core application version alone where customisations or hosting models alter how components interact. A vendor-supported correction may require validation with extensions and business processes before the application returns to normal operation.
Adobe says it has provided an isolated monthly patch intended to let merchants remediate identified issues without waiting for a broader platform upgrade. That distinction is relevant where major commerce installations have scheduled release processes, but it does not remove the need to verify that an affected deployment has received every required correction and any additional hotfix.
The wider October bulletin programme spans other products used in digital operations, including ColdFusion and Experience Manager. Those applications serve different purposes and have separate vulnerabilities, dependencies and corrected versions. An update labelled as part of one supplier's monthly security cycle should not be described as a single flaw affecting all Adobe software.
ColdFusion can form part of application backends, while Experience Manager is frequently used for content and digital experience delivery. Security failures in either category may affect services exposed to customers or staff, but the effect of an individual vulnerability depends on the relevant product bulletin. Adobe's central security advisory catalogue remains the source for identifying exact affected builds and the appropriate remediation.
Encryption-key rotation requires careful coordination. Keys or related secrets may be shared with external integrations or stored by applications, and changing them can interrupt business functions if systems are not updated together. Adobe's recommendation should therefore be treated as a product-specific remedial requirement rather than a general claim that credentials have already been stolen.
The company has not established, through the cited Commerce advisory alone, that the October issue has been exploited against any named European retailer. The presence of a critical rating and a hotfix justifies assessment without supporting claims of an ongoing breach wave. Enterprises operating multiple Adobe products will need to distinguish which installations are within scope.
Adobe's separate 13 October advisories identify additional remediation requirements. ColdFusion bulletin APSB26-144 describes vulnerabilities spanning code execution, security bypass, file access and availability; Adobe says it is unaware of in-the-wild exploitation of the issues in that update. Experience Manager bulletin APSB26-152 similarly covers critical and medium defects with potential code execution, privilege escalation and security-bypass effects, again without Adobe reporting known exploitation. These notices are different from Commerce bulletin APSB26-153 and should be tracked separately by product owner and installed release. Treating the monthly set as one uniform emergency could obscure the distinct upgrade paths and may cause teams to miss the Commerce-specific instruction about its additional hotfix and key rotation.
Adobe's 13 October Commerce documentation specifies an isolated October patch and an additional hotfix for CVE-2026-75650. It also recommends rotating encryption keys and associated credentials. The separate ColdFusion and Experience Manager bulletins describe distinct vulnerabilities and corrections. Adobe says it is unaware of exploitation in the wild for the issues in those two bulletins.
