# Adobe Acrobat/Reader Zero-Day Exploited in Wild

Published: 2023-09-12 · Severity: high
Canonical: https://vorant.io/reports/49a09ef7-8508-510b-94ba-2a799c78948b/adobe-acrobat-reader-zero-day-exploited-in-wild

> Adobe patched an actively exploited flaw (CVE-2023-26369) in Acrobat and Reader; IPA urges immediate updates.

Adobe disclosed a vulnerability tracked as CVE-2023-26369 affecting Acrobat and Reader, covered in security bulletin APSB23-34. Adobe confirmed that exploitation of this flaw has been observed in the wild, prompting Japan's IPA (Information-technology Promotion Agency) to issue an urgent alert recommending immediate patching.

The affected versions span multiple release tracks of Acrobat and Reader for both Windows and macOS, including versions 23.003.20284 and earlier, and 20.005.30514/20.005.30516 and earlier. Users and administrators are advised to update to the latest versions provided by Adobe as soon as possible to mitigate the risk of exploitation. No further technical details on the exploitation method, threat actors, or malware involved were disclosed in this advisory.

## Mentioned in this report

- Vulnerabilities: CVE-2023-26369 (KEV)

## Detection guidance (public sample)

### Suspicious Child Process Spawned by Adobe Acrobat/Reader

ATT&CK: T1203

Detects Acrobat/Reader (AcroRd32.exe/Acrobat.exe) spawning command interpreters or scripting engines, consistent with post-exploitation activity following a PDF-based exploit such as CVE-2023-26369. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned by Adobe Acrobat or Reader
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \\AcroRd32.exe
    - \\Acrobat.exe
    - \\AcroCEF.exe
  suspicious_child:
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\pwsh.exe
    - \\wscript.exe
    - \\cscript.exe
    - \\mshta.exe
    - \\rundll32.exe
    - \\regsvr32.exe
    - \\certutil.exe
    - \\bitsadmin.exe
  condition: selection and suspicious_child
falsepositives:
- Enterprise document workflow tools or plug-ins that legitimately invoke helper scripts
  from Acrobat
- Print-to-PDF or macro-enabled PDF add-ins that shell out to system utilities
level: high
tags:
- attack.t1203
- attack.t1059
id: 8a130122-ce07-5183-9021-90fa1aedbc85
status: experimental
author: Vorant
```

### Adobe Acrobat/Reader Writing Executable or Script Files to Disk

ATT&CK: T1203

Detects Acrobat/Reader processes creating executable, script, or DLL files outside of normal update/cache paths, a pattern consistent with exploit-driven payload drops after opening a malicious PDF. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Adobe Acrobat or Reader Dropping Executable Files
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \\AcroRd32.exe
    - \\Acrobat.exe
    - \\AcroCEF.exe
    TargetFilename|endswith:
    - .exe
    - .dll
    - .ps1
    - .vbs
    - .js
    - .hta
  filter:
    TargetFilename|contains:
    - \\Adobe\\Acrobat\\
    - \\Adobe\\ARM\\
    - \\Program Files\\Adobe\\
    - \\Program Files (x86)\\Adobe\\
  condition: selection and not filter
falsepositives:
- Legitimate Adobe update or plugin installation writing files under Adobe program
  directories
- Enterprise-managed Acrobat auto-update tasks
level: medium
tags:
- attack.t1203
id: 18887500-c07e-58d6-bb60-45646b2b5962
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/0913-adobereader.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/49a09ef7-8508-510b-94ba-2a799c78948b/adobe-acrobat-reader-zero-day-exploited-in-wild.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup