Multiple Adobe products vulnerable to code execution
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Adobe patches critical vulnerabilities across Acrobat, Commerce, AEM, and creative tools; no active exploitation reported.
CIS-ISAC Advisory 2026-020 documents multiple vulnerabilities spanning Adobe's product portfolio. The most severe affect Acrobat Reader (use-after-free, signature verification flaws), Adobe Commerce and Magento (XSS, authorization bypass, path traversal, SSRF), Adobe Experience Manager (32 stored XSS variants), and creative tools including Premiere Pro, Substance 3D, and Illustrator (buffer overflows, out-of-bounds access, null pointer dereference). Successful exploitation of the most critical flaws permits arbitrary code execution in the logged-on user's context, enabling program installation, data manipulation, or privilege escalation depending on user rights. The advisory reports no current in-the-wild exploitation. Patches are available across all affected product lines and versions; defenders should apply updates immediately after testing, with particular urgency for internet-facing Commerce and AEM deployments.
Mentioned in this report
Detection guidance
Adobe Acrobat/Reader Spawning Script Interpreter or LOLBin
Detects Acrobat or Reader spawning a shell, script host or common download/proxy-execution binary, a typical post-exploitation sign after a malicious PDF triggers a memory-corruption flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Acrobat/Reader Spawning Script Interpreter or LOLBin
description: Detects Acrobat or Acrobat Reader spawning a command shell, script host
or common proxy-execution binary. This pattern follows exploitation of a document-parsing
flaw such as use-after-free for client-side code execution. Matches the parent/child
relation, not any specific document or payload.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \AcroRd32.exe
- \Acrobat.exe
- \Acrobat Reader DC.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \msiexec.exe
condition: selection
falsepositives:
- Legacy PDF workflows or plugins that launch cmd.exe for printing or conversion
- Acrobat installer or updater helpers that invoke msiexec or rundll32
level: high
id: aec76ef1-2a85-503f-b851-f9a87ab47d4b
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-020
Adobe Creative Application Spawning Shell or Script Host
Detects Adobe creative tools (Illustrator, Premiere Pro, Photoshop, Media Encoder) spawning a shell or script host, which may indicate exploitation of a file-parsing memory-corruption flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Creative Application Spawning Shell or Script Host
description: Detects Adobe creative applications such as Illustrator, Premiere Pro,
Photoshop and Media Encoder spawning a command shell or script host. Malicious project
or media files that exploit buffer overflow or out-of-bounds flaws can produce this
child process. Generalises on the parent/child relation, not any specific file.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \Illustrator.exe
- \Adobe Premiere Pro.exe
- \Photoshop.exe
- \Adobe Media Encoder.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Creative scripts or extensions that call cmd.exe or PowerShell for export automation
- Plugin installers launched from within the application
level: medium
id: e19ea2ac-3a15-5530-9a50-f5415bdf0a4c
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-020
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-020
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs