# Multiple Adobe products vulnerable to arbitrary code execution

Published: 2026-06-09 · Severity: high · Sectors: Technology, Financial Services, Retail
Canonical: https://vorant.io/reports/045a76b5-55a2-548f-a956-4903ceab2de6/multiple-adobe-products-vulnerable-to-arbitrary-code-execution
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Adobe released patches for critical vulnerabilities across Acrobat, After Effects, Premiere Pro, and other products allowing arbitrary code execution; no active exploitation reported.

Source: cisecurity.org — https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-083

## What to check

- Applies to: The 22 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2025-54236 as exploited in the wild.

Adobe disclosed multiple vulnerabilities across nine products, with the most severe allowing arbitrary code execution in the context of the logged-on user. Affected products include Acrobat and Reader, After Effects, Premiere Pro, Commerce (and Magento Open Source), Substance 3D Viewer, Experience Manager, Dreamweaver, Substance 3D Modeler, and ColdFusion. The vulnerabilities span various weakness classes including use-after-free, buffer overflows, out-of-bounds access, improper input validation, CSRF, SSRF, and path traversal. While no active in-the-wild exploitation has been reported, successful exploitation could allow an attacker to install programs, modify or delete data, or create administrative accounts depending on the compromised user's privilege level.

The advisory provides extensive affected version information across multiple product lines and release tracks. Adobe has released stable channel updates to address these issues. Organizations should prioritize patching based on their deployed products and the severity of the vulnerability classes affecting each. Defenders should apply patches immediately after testing, implement application allowlisting and exploit protection features, enforce least-privilege principles, and maintain vulnerability management processes.

## Mentioned in this report

- Vulnerabilities: CVE-2025-54236 (KEV), CVE-2025-54239, CVE-2025-54240, CVE-2025-54241, CVE-2025-54242, CVE-2025-54243, CVE-2025-54244, CVE-2025-54245, CVE-2025-54246, CVE-2025-54247, CVE-2025-54248, CVE-2025-54249 (templated), CVE-2025-54250, CVE-2025-54251 (templated), CVE-2025-54252, CVE-2025-54255, CVE-2025-54256, CVE-2025-54257, CVE-2025-54258, CVE-2025-54259, CVE-2025-54260, CVE-2025-54261

## Detection guidance (public sample)

### Adobe Acrobat or Reader Spawning Script Interpreter or LOLBin

ATT&CK: T1203

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Acrobat/Reader launching cmd, PowerShell, script hosts or common download/proxy-execution binaries, which is typical of a malicious PDF exploiting a client-side flaw such as use-after-free or buffer overflow. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Adobe Acrobat or Reader Spawning Script Interpreter or LOLBin
description: Detects Adobe Acrobat/Reader spawning command interpreters, script hosts
  or living-off-the-land binaries. After exploitation of a memory-corruption bug in
  the PDF renderer, shellcode commonly launches these to stage a payload in the context
  of the logged-on user.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \AcroRd32.exe
    - \Acrobat.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
    - \wmic.exe
  condition: selection
falsepositives:
- PDF workflows or plug-ins that deliberately shell out to cmd.exe, for example some
  enterprise document-management integrations
- Adobe installer or repair actions that launch msiexec.exe from Acrobat
level: high
id: 095d909b-647b-5e4d-ab4d-d61e53d1a4a6
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-083
```

### Adobe Acrobat or Reader Launching Executable From User-Writable Path

ATT&CK: T1203

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Acrobat/Reader starting a child process whose image is in a temp, public or user-profile download location, suggesting a payload dropped and run after exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Adobe Acrobat or Reader Launching Executable From User-Writable Path
description: Detects Acrobat/Reader creating a child process whose binary resides
  in a user-writable staging directory (Temp, Users\Public, Downloads). This pattern
  follows exploitation of a document-parsing flaw that drops and executes a second-stage
  payload.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \AcroRd32.exe
    - \Acrobat.exe
    Image|contains:
    - \AppData\Local\Temp\
    - \Users\Public\
    - \Downloads\
  filter_adobe:
    Image|contains:
    - \Adobe\
    - \Acrobat\
  condition: selection and not filter_adobe
falsepositives:
- Acrobat opening an attachment that launches an installer extracted to Temp
- Users launching a downloaded helper tool from a PDF via an embedded launch action
level: medium
id: 059120ac-c303-5cc5-9e1b-bef1cae8b56c
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-083
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-083

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/045a76b5-55a2-548f-a956-4903ceab2de6/multiple-adobe-products-vulnerable-to-arbitrary-code-execution.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup