Adobe Acrobat/Reader Zero-Day Exploited in Wild
Adobe patched an actively exploited flaw (CVE-2023-26369) in Acrobat and Reader; IPA urges immediate updates.
Adobe disclosed a vulnerability tracked as CVE-2023-26369 affecting Acrobat and Reader, covered in security bulletin APSB23-34. Adobe confirmed that exploitation of this flaw has been observed in the wild, prompting Japan's IPA (Information-technology Promotion Agency) to issue an urgent alert recommending immediate patching.
The affected versions span multiple release tracks of Acrobat and Reader for both Windows and macOS, including versions 23.003.20284 and earlier, and 20.005.30514/20.005.30516 and earlier. Users and administrators are advised to update to the latest versions provided by Adobe as soon as possible to mitigate the risk of exploitation. No further technical details on the exploitation method, threat actors, or malware involved were disclosed in this advisory.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Adobe Acrobat/Reader
Detects Acrobat/Reader (AcroRd32.exe/Acrobat.exe) spawning command interpreters or scripting engines, consistent with post-exploitation activity following a PDF-based exploit such as CVE-2023-26369. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Adobe Acrobat or Reader
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \\AcroRd32.exe
- \\Acrobat.exe
- \\AcroCEF.exe
suspicious_child:
Image|endswith:
- \\cmd.exe
- \\powershell.exe
- \\pwsh.exe
- \\wscript.exe
- \\cscript.exe
- \\mshta.exe
- \\rundll32.exe
- \\regsvr32.exe
- \\certutil.exe
- \\bitsadmin.exe
condition: selection and suspicious_child
falsepositives:
- Enterprise document workflow tools or plug-ins that legitimately invoke helper scripts
from Acrobat
- Print-to-PDF or macro-enabled PDF add-ins that shell out to system utilities
level: high
tags:
- attack.t1203
- attack.t1059
id: 8a130122-ce07-5183-9021-90fa1aedbc85
status: experimental
author: Vorant
Adobe Acrobat/Reader Writing Executable or Script Files to Disk
Detects Acrobat/Reader processes creating executable, script, or DLL files outside of normal update/cache paths, a pattern consistent with exploit-driven payload drops after opening a malicious PDF. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Acrobat or Reader Dropping Executable Files
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \\AcroRd32.exe
- \\Acrobat.exe
- \\AcroCEF.exe
TargetFilename|endswith:
- .exe
- .dll
- .ps1
- .vbs
- .js
- .hta
filter:
TargetFilename|contains:
- \\Adobe\\Acrobat\\
- \\Adobe\\ARM\\
- \\Program Files\\Adobe\\
- \\Program Files (x86)\\Adobe\\
condition: selection and not filter
falsepositives:
- Legitimate Adobe update or plugin installation writing files under Adobe program
directories
- Enterprise-managed Acrobat auto-update tasks
level: medium
tags:
- attack.t1203
id: 18887500-c07e-58d6-bb60-45646b2b5962
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/0913-adobereader.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free