Adobe patches 50+ flaws across nine products
Adobe released security updates for nine products fixing over 50 vulnerabilities, including critical arbitrary code execution flaws in After Effects, Premiere Pro, and Illustrator.
Adobe has issued security advisories addressing multiple vulnerabilities across nine of its products, with the most severe issues allowing arbitrary code execution. The affected products span creative tools (After Effects, Premiere Pro, Illustrator, Substance 3D suite), enterprise platforms (Commerce, Connect), and developer SDKs (Content Authenticity). Critical vulnerabilities include stack-based and heap-based buffer overflows in After Effects, out-of-bounds write flaws in Premiere Pro and Media Encoder, and memory corruption issues in Illustrator and the Substance 3D applications.
The Adobe Commerce platform is affected by multiple web application vulnerabilities including stored cross-site scripting, path traversal, server-side request forgery, and incorrect authorization issues. Adobe Connect suffers from a deserialization vulnerability and authorization flaws. The Content Authenticity SDK contains numerous input validation and resource consumption issues affecting both JavaScript and Rust implementations. MS-ISAC reports no evidence of active exploitation in the wild.
Successful exploitation could allow attackers to execute arbitrary code in the context of the logged-on user, potentially leading to full system compromise on systems where users operate with administrative privileges. Adobe has released patches for all affected versions, and organizations should prioritize deployment according to their risk-based remediation strategy.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Adobe Creative/Enterprise Applications
Detects command shells or script interpreters spawned by Adobe After Effects, Premiere Pro, Media Encoder, Illustrator, Substance 3D, or Connect processes, which may indicate exploitation of a memory-corruption or deserialization vulnerability leading to arbitrary code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Adobe Application
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \AfterFX.exe
- \Adobe Premiere Pro.exe
- \Adobe Media Encoder.exe
- \Illustrator.exe
- \Substance3DPainter.exe
- \Substance3DDesigner.exe
- \Substance3DSampler.exe
- \connect.exe
- \ConnectPro.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
condition: selection_parent and selection_child
falsepositives:
- Legitimate scripting/automation plugins or extensions that legitimately invoke
shell commands from Adobe applications
- Third-party install/update helpers launched from Adobe product folders
level: high
tags:
- attack.t1203
- attack.execution
id: a6a8f725-4726-57e3-bd8c-90ddc317e85c
status: experimental
author: Vorant
Adobe Commerce or Connect Server Process Spawning Shell After Deserialization/RCE Attempt
Detects a web server or application process associated with Adobe Commerce or Adobe Connect spawning a command interpreter, which can indicate successful exploitation of a deserialization, SSRF, or authorization flaw leading to remote code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Shell Consistent with Adobe Commerce or Connect
Exploitation
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \php-cgi.exe
- \php.exe
- \w3wp.exe
- \httpd.exe
- \tomcat.exe
- \java.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \bash.exe
- \whoami.exe
- \net.exe
filter_common_admin:
CommandLine|contains:
- composer
- deploy
- artisan
condition: selection_parent and selection_child and not filter_common_admin
falsepositives:
- Legitimate deployment or build scripts invoked by the web application server (e.g.
composer, artisan commands)
- Scheduled maintenance jobs that shell out from the application server process
level: medium
tags:
- attack.t1203
- attack.execution
id: b7f39516-d9f3-5ee9-896b-a4d6d8829178
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-046
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free