# Multiple Adobe products vulnerable to code execution

Published: 2026-03-10 · Severity: routine · Sectors: retail, technology, financial-services, manufacturing
Canonical: https://vorant.io/reports/0447e109-9dd7-5347-991d-e24ebf9e827a/multiple-adobe-products-vulnerable-to-code-execution

> Adobe patches critical vulnerabilities across Acrobat, Commerce, AEM, and creative tools; no active exploitation reported.

CIS-ISAC Advisory 2026-020 documents multiple vulnerabilities spanning Adobe's product portfolio. The most severe affect Acrobat Reader (use-after-free, signature verification flaws), Adobe Commerce and Magento (XSS, authorization bypass, path traversal, SSRF), Adobe Experience Manager (32 stored XSS variants), and creative tools including Premiere Pro, Substance 3D, and Illustrator (buffer overflows, out-of-bounds access, null pointer dereference). Successful exploitation of the most critical flaws permits arbitrary code execution in the logged-on user's context, enabling program installation, data manipulation, or privilege escalation depending on user rights. The advisory reports no current in-the-wild exploitation. Patches are available across all affected product lines and versions; defenders should apply updates immediately after testing, with particular urgency for internet-facing Commerce and AEM deployments.

## Mentioned in this report

- Vulnerabilities: CVE-2026-21282, CVE-2026-21284, CVE-2026-21285, CVE-2026-21286, CVE-2026-21289, CVE-2026-21290, CVE-2026-21291, CVE-2026-21292, CVE-2026-21293, CVE-2026-21294, CVE-2026-21295, CVE-2026-21296, CVE-2026-21297, CVE-2026-21309, CVE-2026-21310, CVE-2026-21311, CVE-2026-21333, CVE-2026-21359, CVE-2026-21360, CVE-2026-21361, CVE-2026-21362, CVE-2026-21363, CVE-2026-21364, CVE-2026-27220, CVE-2026-27221, CVE-2026-27223, CVE-2026-27224, CVE-2026-27225, CVE-2026-27227, CVE-2026-27228, CVE-2026-27247, CVE-2026-27269, CVE-2026-27271, CVE-2026-27273, CVE-2026-27274, CVE-2026-27275, CVE-2026-27276, CVE-2026-27278, CVE-2026-27280, CVE-2026-27281

## Detection guidance (public sample)

### Adobe Acrobat/Reader Spawning Script Interpreter or LOLBin

ATT&CK: T1203

Detects Acrobat or Reader spawning a shell, script host or common download/proxy-execution binary, a typical post-exploitation sign after a malicious PDF triggers a memory-corruption flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Adobe Acrobat/Reader Spawning Script Interpreter or LOLBin
description: Detects Acrobat or Acrobat Reader spawning a command shell, script host
  or common proxy-execution binary. This pattern follows exploitation of a document-parsing
  flaw such as use-after-free for client-side code execution. Matches the parent/child
  relation, not any specific document or payload.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \AcroRd32.exe
    - \Acrobat.exe
    - \Acrobat Reader DC.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
  condition: selection
falsepositives:
- Legacy PDF workflows or plugins that launch cmd.exe for printing or conversion
- Acrobat installer or updater helpers that invoke msiexec or rundll32
level: high
id: aec76ef1-2a85-503f-b851-f9a87ab47d4b
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-020
```

### Adobe Creative Application Spawning Shell or Script Host

ATT&CK: T1203

Detects Adobe creative tools (Illustrator, Premiere Pro, Photoshop, Media Encoder) spawning a shell or script host, which may indicate exploitation of a file-parsing memory-corruption flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Adobe Creative Application Spawning Shell or Script Host
description: Detects Adobe creative applications such as Illustrator, Premiere Pro,
  Photoshop and Media Encoder spawning a command shell or script host. Malicious project
  or media files that exploit buffer overflow or out-of-bounds flaws can produce this
  child process. Generalises on the parent/child relation, not any specific file.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \Illustrator.exe
    - \Adobe Premiere Pro.exe
    - \Photoshop.exe
    - \Adobe Media Encoder.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Creative scripts or extensions that call cmd.exe or PowerShell for export automation
- Plugin installers launched from within the application
level: medium
id: e19ea2ac-3a15-5530-9a50-f5415bdf0a4c
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-020
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-020

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/0447e109-9dd7-5347-991d-e24ebf9e827a/multiple-adobe-products-vulnerable-to-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup