Adobe Acrobat and Reader vulnerability CVE-2021-28550 actively exploited in the wild

Published11 May 2021 Vorant ratinghigh vulnerability

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Adobe Acrobat and Reader vulnerability CVE-2021-28550 actively exploited in the wild; immediate patching required per APSB21-29 advisory.

Sourceipa.go.jp — open the original

What to check

Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
Exploitation: CISA lists CVE-2021-28550 as exploited in the wild.

Japan's Information-technology Promotion Agency (IPA) issued an urgent security alert regarding Adobe Acrobat and Reader vulnerabilities disclosed in Adobe security bulletin APSB21-29. Adobe Systems has confirmed active exploitation of CVE-2021-28550 in the wild, prompting the advisory for immediate patch deployment. The vulnerability affects multiple versions of both Acrobat and Reader across Windows and macOS platforms, including continuous track versions 2021.001.20150 and earlier, classic track versions 2020.001.30020 and earlier, and extended support release versions 2017.011.30194 and earlier. IPA emphasizes the critical nature of this update given the confirmed exploitation and urges all users to upgrade to the latest versions provided by Adobe Systems immediately.

Mentioned in this report

Vulnerabilities CVE-2021-28550KEV

Detection guidance

Suspicious Child Process Spawned by Adobe Acrobat/Reader

ATT&CK T1203 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects Adobe Acrobat or Reader (Acrobat.exe/AcroRd32.exe) spawning command interpreters or scripting engines, consistent with exploitation of a memory-corruption vulnerability such as CVE-2021-28550 leading to code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process from Adobe Acrobat or Reader
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \Acrobat.exe
    - \AcroRd32.exe
    - \RdrCEF.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate Acrobat plugins or update mechanisms invoking helper scripts (rare)
- Enterprise PDF automation workflows that call scripting engines from Acrobat
level: high
tags:
- attack.t1203
- attack.execution
id: 9343279a-b73c-5801-8504-0bcf90110a52
author: Vorant

Adobe Acrobat/Reader Process Crash Followed by Unexpected Executable Write

ATT&CK T1105 · status experimental · needs windows file_event logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects Adobe Acrobat or Reader writing a new executable or script file shortly after launch, which can indicate exploitation of a PDF parsing vulnerability (e.g. CVE-2021-28550) resulting in dropped payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Executable File Written by Adobe Acrobat or Reader Process
status: experimental
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
    - \Acrobat.exe
    - \AcroRd32.exe
    - \RdrCEF.exe
  selection_target:
    TargetFilename|endswith:
    - .exe
    - .dll
    - .scr
    - .ps1
    - .vbs
    - .bat
  filter_common:
    TargetFilename|contains:
    - \Adobe\Acrobat\
    - \Adobe\Acrobat DC\
    - \Adobe\Reader\
  condition: selection_image and selection_target and not filter_common
falsepositives:
- Adobe update processes writing installer files in program directories
- Legitimate plugin installation dropping DLLs in the Adobe install folder
level: medium
tags:
- attack.t1105
id: 56c3cd69-2bf5-505e-b51f-6e3879e81419
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/20210512-adobereader.html

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs