Adobe patches 50+ RCE flaws across product suite

Adobe fixed over 50 vulnerabilities in After Effects, Commerce/Magento, Connect, Premiere Pro, Illustrator and other products, several enabling arbitrary code execution.

Adobe has released patches addressing a large batch of vulnerabilities spanning After Effects, Commerce (including Magento Open Source and Commerce B2B), Connect, Media Encoder, Premiere Pro, Substance 3D Designer/Painter/Sampler, the Content Authenticity SDK, and Illustrator. The most severe issues include stack- and heap-based buffer overflows, out-of-bounds read/write, use-after-free, integer overflow/underflow, deserialization of untrusted data, and SSRF, which could allow arbitrary code execution in the context of the logged-on user if a victim opens a malicious file or an attacker exploits a vulnerable web-facing Commerce/Magento instance.

Adobe Commerce and Magento Open Source carry additional risk given their exposure as internet-facing e-commerce platforms, with flaws including incorrect/improper authorization, stored XSS, path traversal, and SSRF that could enable account takeover or server-side compromise beyond simple code execution on an end-user's machine. There are currently no reports of in-the-wild exploitation for any of these vulnerabilities, but given the breadth of affected creative and e-commerce products, organizations should prioritize patching per Adobe's stable channel updates, especially internet-facing Commerce/Magento deployments.

CISA/MS-ISAC recommends standard vulnerability management practices: prompt patch application after testing, least-privilege configurations, application allowlisting, anti-exploitation mitigations, and host-based intrusion detection/prevention to reduce risk from potential future exploitation.

title: Adobe Application Spawning Shell or Script Interpreter
description: Detects Adobe creative suite applications spawning command shells or
  script interpreters, typical of exploitation via malicious document or project file.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \AfterFX.exe
    - \Premiere.exe
    - \Illustrator.exe
    - \MediaEncoder.exe
    - \Adobe Substance 3D Designer.exe
    - \Adobe Substance 3D Painter.exe
    - \Adobe Substance 3D Sampler.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
  filter_adobe_legitimate:
    CommandLine|contains:
    - /s
    - /c dir
    - /c echo
  condition: selection and not filter_adobe_legitimate
falsepositives:
- Adobe plugins or extensions launching scripts for legitimate automation
- IT deployment tools invoking Adobe via shell wrappers
level: high
id: 038cd77e-9bc1-5eab-bacf-b2941c1fc8c1
status: experimental
author: Vorant

title: Adobe Commerce/Magento Spawning Network or Shell Utility
description: Detects Adobe Commerce/Magento-related processes (PHP, Apache, nginx
  parent) spawning network tools or interpreters following successful exploit.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \php.exe
    - \php-cgi.exe
    - \httpd.exe
    - \nginx.exe
    Image|endswith:
    - \curl.exe
    - \wget.exe
    - \nc.exe
    - \powershell.exe
    - \cmd.exe
  filter_legitimate_commerce:
    CommandLine|contains:
    - --version
    - -h
    - --help
  condition: selection and not filter_legitimate_commerce
falsepositives:
- Commerce extensions legitimately invoking curl for payment gateway calls
- Magento backup or monitoring scripts using wget
level: medium
id: 393ed756-fe6d-5bef-9538-539c95ae6d1d
status: experimental
author: Vorant

title: Adobe Application Writing to Startup or System Directories
description: Detects Adobe processes writing .exe, .dll, .vbs, .ps1 files to Windows
  startup, System32, or user AppData locations following potential exploitation.
tags:
- attack.execution
- attack.persistence
- attack.t1203
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \AfterFX.exe
    - \Premiere.exe
    - \Illustrator.exe
    - \MediaEncoder.exe
    - \php.exe
    - \php-cgi.exe
    TargetFilename|contains:
    - \System32\
    - \SysWOW64\
    - \AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    - \ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
    TargetFilename|endswith:
    - .exe
    - .dll
    - .vbs
    - .ps1
    - .scr
  filter_adobe_updates:
    TargetFilename|contains: Adobe
  condition: selection and not filter_adobe_updates
falsepositives:
- Adobe plugin installers writing to AppData during setup
- Commerce platform legitimate file uploads in temp locations
level: high
id: 79174d0c-f12d-5e57-93c8-9e7529beb8e9
status: experimental
author: Vorant

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-046