VULNpocalypse
MediumVulnerabilityPatch available

HKCERT reports Adobe November 2026 security update for nine products

HKCERT reports Adobe released its November 2026 monthly update covering nine products rated Medium; apply the vendor fixes.

Published
Exploitation
No evidence in the source; HKCERT does not say any of these issues are exploited

What happened

According to HKCERT, Adobe has released its monthly security update for November 2026. HKCERT published its bulletin on 11 Nov 2026 and rates the overall risk as Medium. HKCERT says the update covers nine products, all rated Medium, with none rated High or Extremely High. HKCERT: Adobe Monthly Security Update (November 2026)

HKCERT lists these products, the impact types it attributes to each, and Adobe bulletin IDs:

  • Adobe After Effects (APSB26-100): remote code execution, denial of service, information disclosure.
  • Adobe Audition (APSB26-102): remote code execution, elevation of privilege, denial of service.
  • Adobe Connect (APSB26-191): remote code execution, elevation of privilege, information disclosure.
  • Adobe Content Credentials SDK (APSB26-184): security restriction bypass, data manipulation, denial of service.
  • Adobe Dimension (APSB26-190): remote code execution.
  • Adobe Experience Manager (APSB26-189): remote code execution, elevation of privilege, security restriction bypass.
  • Adobe Media Encoder (APSB26-103): remote code execution, denial of service.
  • Adobe Photoshop (APSB26-181): remote code execution, denial of service, information disclosure.
  • Adobe Premiere (APSB26-101): remote code execution, data manipulation, information disclosure, denial of service.

What is not confirmed: the HKCERT bulletin names no CVE identifiers, so individual CVEs are not confirmed here. It gives no fixed version numbers, no CVSS scores and no statement about exploitation. This is a single-source summary of Adobe’s release, and the underlying Adobe bulletins were not part of the material reviewed.

Am I affected?

HKCERT lists these versions as affected (“and earlier”):

  • Adobe After Effects 25.6.6 and 26.5
  • Adobe Audition 25.6.6 and 26.5
  • Adobe Connect 12.12
  • Adobe Dimension 4.1.9
  • Adobe Experience Manager (AEM) 6.5 LTS Service Pack 3, AEM 6.5 Service Pack 25, and AEM Cloud Service 2026.10.29023
  • Adobe Media Encoder 25.6.6 and 26.5.2
  • Adobe Photoshop 2025 26.11.8 and Photoshop 2026 27.11
  • Adobe Premiere 25.6.6 and 26.5.2
  • C2PA Tool c2patool-v0.28.5
  • Content Credentials Rust SDK c2pa-v0.91.10 (HKCERT’s text reads “and earlie”, apparently truncated)

If you run none of these products, HKCERT’s bulletin gives no reason to think you are affected. Whether a given issue is exploitable in your setup is not confirmed.

What to do now

  1. Check which of the products above are installed or deployed in your environment, including the Content Credentials tooling and Experience Manager instances.
  2. Compare installed versions with the affected versions HKCERT lists.
  3. Apply the fixes issued by Adobe, as HKCERT advises. Use each product’s software update, or follow the details for each bulletin ID on Adobe’s security bulletins and advisories page.
  4. Before installing, visit Adobe’s website for product-specific details, as HKCERT recommends.
  5. Look up CVE identifiers and fixed version numbers in Adobe’s own bulletins, since the HKCERT summary does not give them.

Sources