Adobe patches arbitrary code execution across 13 products
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Adobe releases fixes for multiple critical and high-severity vulnerabilities across Creative Cloud, Commerce, Connect, and other products; no active exploitation reported.
CIS has published an advisory covering 40+ vulnerabilities across 13 Adobe product lines, with the most severe allowing arbitrary code execution in the context of the logged-on user. The affected products span Creative Cloud applications (Illustrator, Animate, Bridge, Dimension), digital asset and content management systems (Experience Manager, Substance 3D suite), collaboration software (Connect), e-commerce platforms (Commerce, Magento Open Source), and authoring tools (FrameMaker). Vulnerability classes include memory safety issues (heap buffer overflows, use-after-free, out-of-bounds read/write), logic flaws (TOCTOU race conditions, improper access control), and web application issues (DOM-based and stored XSS, open redirect). Adobe Connect is affected by XSS and open redirect flaws; Commerce and Magento by XSS and access control bypasses; Creative Cloud desktop by a TOCTOU race condition in update checking. The Adobe Bridge, Animate, Illustrator, FrameMaker, and Substance 3D tools contain memory corruption bugs that could lead to code execution. The advisory reports no evidence of in-the-wild exploitation, making this a patch-management priority rather than an incident-response trigger. Defenders should prioritize updates to systems running recent versions of these tools, particularly those with user-facing attack surfaces like Connect and Commerce.
Mentioned in this report
Detection guidance
Adobe Creative Application Spawning Shell or Scripting LOLBin
Adobe Illustrator, Bridge, Animate, FrameMaker or Dimension spawning a command shell, script host or common LOLBin, which is consistent with post-exploitation of a memory-corruption bug. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Creative Application Spawning Shell or Scripting LOLBin
description: Detects Adobe Illustrator, Bridge, Animate, FrameMaker or Dimension spawning
a command shell, script host or common living-off-the-land binary. The advisory
describes memory corruption bugs in these tools that allow code execution as the
logged-on user. Those tools rarely start interpreters, so a child process like this
is a generic sign of client-side exploitation. Not tied to any specific CVE or payload.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \Illustrator.exe
- \Bridge.exe
- \Adobe Bridge.exe
- \Animate.exe
- \FrameMaker.exe
- \Dimension.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \msiexec.exe
filter_adobe_helpers:
CommandLine|contains:
- \Adobe\Adobe Creative Cloud
- CCLibrary
- AdobeIPCBroker
condition: selection_parent and selection_child and not filter_adobe_helpers
falsepositives:
- Animate or FrameMaker export/publish workflows and third-party plugins that call
cmd.exe for build or conversion scripts
- Adobe installer or updater helper processes launched from within the application
level: medium
id: f30a1310-55fd-5ff2-8f31-8aa8681a151a
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-097
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-097
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs