Adobe Acrobat and Reader vulnerability CVE-2021-28550 actively exploited in the wild
Adobe Acrobat and Reader vulnerability CVE-2021-28550 actively exploited in the wild; immediate patching required per APSB21-29 advisory.
Japan's Information-technology Promotion Agency (IPA) issued an urgent security alert regarding Adobe Acrobat and Reader vulnerabilities disclosed in Adobe security bulletin APSB21-29. Adobe Systems has confirmed active exploitation of CVE-2021-28550 in the wild, prompting the advisory for immediate patch deployment. The vulnerability affects multiple versions of both Acrobat and Reader across Windows and macOS platforms, including continuous track versions 2021.001.20150 and earlier, classic track versions 2020.001.30020 and earlier, and extended support release versions 2017.011.30194 and earlier. IPA emphasizes the critical nature of this update given the confirmed exploitation and urges all users to upgrade to the latest versions provided by Adobe Systems immediately.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Adobe Acrobat/Reader
Detects Adobe Acrobat or Reader (Acrobat.exe/AcroRd32.exe) spawning command interpreters or scripting engines, consistent with exploitation of a memory-corruption vulnerability such as CVE-2021-28550 leading to code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process from Adobe Acrobat or Reader
status: experimental
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \Acrobat.exe
- \AcroRd32.exe
- \RdrCEF.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection_parent and selection_child
falsepositives:
- Legitimate Acrobat plugins or update mechanisms invoking helper scripts (rare)
- Enterprise PDF automation workflows that call scripting engines from Acrobat
level: high
tags:
- attack.t1203
- attack.execution
id: 9343279a-b73c-5801-8504-0bcf90110a52
author: Vorant
Adobe Acrobat/Reader Process Crash Followed by Unexpected Executable Write
Detects Adobe Acrobat or Reader writing a new executable or script file shortly after launch, which can indicate exploitation of a PDF parsing vulnerability (e.g. CVE-2021-28550) resulting in dropped payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Executable File Written by Adobe Acrobat or Reader Process
status: experimental
logsource:
category: file_event
product: windows
detection:
selection_image:
Image|endswith:
- \Acrobat.exe
- \AcroRd32.exe
- \RdrCEF.exe
selection_target:
TargetFilename|endswith:
- .exe
- .dll
- .scr
- .ps1
- .vbs
- .bat
filter_common:
TargetFilename|contains:
- \Adobe\Acrobat\
- \Adobe\Acrobat DC\
- \Adobe\Reader\
condition: selection_image and selection_target and not filter_common
falsepositives:
- Adobe update processes writing installer files in program directories
- Legitimate plugin installation dropping DLLs in the Adobe install folder
level: medium
tags:
- attack.t1105
- attack.defense-evasion
id: 56c3cd69-2bf5-505e-b51f-6e3879e81419
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/20210512-adobereader.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free