Adobe released fixes for critical and medium-severity vulnerabilities in Adobe Experience Manager (AEM) on October 13, 2026. Adobe’s advisory lists arbitrary code execution, security-feature bypass and privilege escalation as possible impacts and assigns deployment priority 2. Zero Day Initiative reported 33 distinct CVEs, explaining that Adobe’s table has 34 entries because CVE-2026-106631 appears twice. According to Adobe, three incorrect-authorization flaws score 10.0 on the Common Vulnerability Scoring System and allow code execution over a network without privileges or user interaction. Adobe reported no known exploitation at publication. Sources: Adobe, Zero Day Initiative
NewsEditorialSource: Adobe
Adobe fixes critical vulnerabilities in Experience Manager
Why it matters
Affected versions on all platforms include AEM Cloud Service 2026.9.28187 and earlier, AEM 6.5 Service Pack 25 and earlier, and AEM 6.5 LTS (long-term support) Service Pack 3 and earlier. [1] Adobe lists the fixes as Cloud Service 2026.9.28386, AEM 6.5 Service Pack 25 plus listed hotfixes, and AEM 6.5 LTS Service Pack 3 plus listed hotfixes. [1] Teams should inventory editions and hotfixes, prioritize exposed installations, and follow Adobe’s product-specific solution links for the complete update set because affected vulnerabilities differ by edition. [1] The review did not inspect downloadable packages, installation prerequisites or individual cloud deployment status.
Attribution
Sources
- 1AdobeSecurity update available for Adobe Experience Manager | APSB26-152Source published (UTC)
- 2Zero Day InitiativeThe October 2026 Security Update ReviewSource published (UTC)
Read the original source for full details and context.
EditorialSource: KrakenD
KrakenD releases Enterprise 2.13.11 security backport and Community and Enterprise 3.0.1
KrakenD released Enterprise Edition 2.13.11 as a recommended security backport on October 13, 2026, according to its changelog. [1] The changelog also lists Community and Enterprise Edition 3.0.1 releases that day. [1] It says the backport upgrades Go to 1.26.9 and updates amqp and OpenTelemetry dependencies for listed security issues. [1] According to Red Hat, CVE-2026-97032 lets an unauthenticated remote attacker crash Go’s HTTP/2 server if they win an HPACK encoder race. [2] KrakenD says affected versions are exposed when the gateway accepts HTTP/2 through Transport Layer Security negotiation or use_h2c. [3]
EditorialSource: Microsoft
Microsoft releases October security updates for .NET and .NET Framework
Microsoft’s October servicing announcement lists .NET updates dated October 13, 2026, alongside new .NET Framework security and non-security updates. [1] The .NET releases—10.0.13, 9.0.21 and 8.0.32—include security and non-security fixes. Microsoft’s announcement links to release notes, installers, binaries and container images. [1] Microsoft’s .NET 10 release notes list fixes for information disclosure and denial of service. [3] BleepingComputer reported that the updates also address CVE-2026-108398, a .NET Framework security-feature bypass publicly disclosed before patching. [2]
EditorialSource: Chrome Releases
Google patches 37 Chrome 155 security flaws
Google announced a Chrome 155 desktop update on October 13, 2026, addressing 37 security issues. Google listed versions 155.0.8059.79/.80 for Windows and macOS and 155.0.8059.79 for Linux, with distribution planned over the following days or weeks.