Adobe and Microsoft both landed oversized August security batches on August 11. Adobe issued five bulletins for 51 CVEs across ColdFusion, Campaign Classic, Commerce, Lightroom Classic, and Content Credentials SDK; Campaign Classic and ColdFusion were both marked deployment priority 1. Microsoft’s August release adds 398 CVEs across Windows, Office, Exchange, SharePoint, Teams, and other products, with one issue listed as under active attack.
For Adobe, the ordering matters more than the count: Campaign Classic contains two CVSS 10 flaws and supersedes a patch Adobe issued on August 3, while ColdFusion also carries a CVSS 10 bug. Microsoft’s batch is much larger, but the vendor flags only one problem as actively attacked, which separates the urgent item from the rest of the volume.
For teams with Adobe or Microsoft estates, this is a triage story about backlog density and vendor priority, not a new exploit pattern. The practical exposure sits with whichever products are already in your environment; the size of the release just determines how carefully the urgent fixes have to be picked out from the bulk.
1 source · Aug 11
CVEs in this update
420 CVEs
Across Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2, and related packages.
Zero Day Initiative — The August 2026 Security Update Review
I’ve successfully survived Hacker Summer Camp, and I have returned with a new outlook on patch density. When even Linus Torvalds says that huge updates are the “ new normal ”, it’s time to readjust what we consider a true bug apocalypse. This month’s release is thankfully smaller than last months, b