Adobe and SAP released their October security updates Tuesday, and both include flaws rated 10.0, the top of the severity scale. Adobe's batch is part of the twice-monthly schedule it adopted in July, on the second and fourth Tuesday of each month, which it tied to faster vulnerability discovery in what it called "the era of frontier AI." For companies running SAP and Adobe business software, that means more frequent patch cycles to plan, test and staff.

Neither company has reported any of the new flaws being exploited.

What Happened

SAP's October Security Patch Day brought 16 new security notes, four advisories published on GitHub and updates to two earlier notes. Four of the new items are rated Critical, three High, 12 Medium and one Low.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

The highest-rated, CVE-2026-89111, affects SAP Cloud SDK for Python, a software library developers use to build applications on SAP's Business Technology Platform. Versions before 0.45.2 contain a server-side request forgery flaw, meaning an attacker can make the application send requests to a destination of the attacker's choosing. Citing SAP's GitHub advisory, SecurityWeek reported that in multi-tenant apps an attacker who controls a tenant subdomain setting can redirect login-token requests and capture the app's client credentials. heise online reported that those credentials open everything the application is allowed to reach, such as data in S/4HANA or SuccessFactors.

The other three Critical notes cover broken access control in SAP NetWeaver Visual Composer (9.9), code injection in the rules for substitutions and validations in S/4HANA (9.9) and a missing authorization check in SAP Manufacturing Integration and Intelligence (9.1). Onapsis, a company that sells SAP security products, said the S/4HANA flaw could let a user with a specific business role run arbitrary code and take over the system, SecurityWeek reported. High-rated fixes cover SQL injection in SAP Commerce Cloud, memory corruption in the component that handles web traffic for NetWeaver and SAP Web Dispatcher, and a missing authorization check in the ABAP Platform.

Adobe's releases cover 11 products. SecurityWeek counted about 176 vulnerabilities, while heise counted 174. The ColdFusion bulletin lists 32 flaws, 10 of them critical, including two scored 10.0: an unrestricted file upload that allows code execution and a request-forgery flaw that allows privilege escalation. Fixed versions are ColdFusion 2025.0.14 and 2023.0.26.

The Experience Manager bulletin lists 35 unique flaws, 14 critical, among them three incorrect-authorization bugs scored 10.0 that allow code execution. The Commerce bulletin, which also covers Magento Open Source, lists 11 flaws, including CVE-2026-103849, a 10.0-rated template injection that lets an attacker run code without logging in. Adobe also tells Commerce customers who applied its September critical update to install an additional hotfix.

Why It Matters

The SAP library flaw is unusual because it lives inside software customers write themselves. Fixing it requires development teams to update a dependency and redeploy their applications, work that an operations team applying SAP notes may not see. Stolen client credentials would let an attacker act as a trusted application rather than as an outsider.

Adobe's bulletins give Commerce, Experience Manager and ColdFusion priority 2. SecurityWeek said most of the other advisories carry priority 3, a rating that signals Adobe does not expect the flaws to be exploited. Commerce powers online stores, so a flaw there that needs no login could expose checkout systems and customer data.

The schedule change matters beyond Adobe. Microsoft's October release passed 1,400 fixes, and outlets have tied that rise to AI-assisted bug hunting as well. SecurityWeek reported that Adobe engineers still review and approve every AI-assisted code change before deployment. Security leaders who budget patching around one monthly window now face more releases and more items per release.

What to Watch

Watch for exploitation reports, particularly for Commerce, which SecurityWeek noted attackers have targeted in the past. Adobe's next scheduled bulletins are due Oct. 27, the fourth Tuesday of the month. Companies using SAP Cloud SDK for Python should confirm that every multi-tenant app has moved to version 0.45.2 or later.