Adobe patches 50+ RCE flaws across product suite
Adobe fixed over 50 vulnerabilities in After Effects, Commerce/Magento, Connect, Premiere Pro, Illustrator and other products, several enabling arbitrary code execution.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Adobe has released patches addressing a large batch of vulnerabilities spanning After Effects, Commerce (including Magento Open Source and Commerce B2B), Connect, Media Encoder, Premiere Pro, Substance 3D Designer/Painter/Sampler, the Content Authenticity SDK, and Illustrator. The most severe issues include stack- and heap-based buffer overflows, out-of-bounds read/write, use-after-free, integer overflow/underflow, deserialization of untrusted data, and SSRF, which could allow arbitrary code execution in the context of the logged-on user if a victim opens a malicious file or an attacker exploits a vulnerable web-facing Commerce/Magento instance.
Adobe Commerce and Magento Open Source carry additional risk given their exposure as internet-facing e-commerce platforms, with flaws including incorrect/improper authorization, stored XSS, path traversal, and SSRF that could enable account takeover or server-side compromise beyond simple code execution on an end-user's machine. There are currently no reports of in-the-wild exploitation for any of these vulnerabilities, but given the breadth of affected creative and e-commerce products, organizations should prioritize patching per Adobe's stable channel updates, especially internet-facing Commerce/Magento deployments.
CISA/MS-ISAC recommends standard vulnerability management practices: prompt patch application after testing, least-privilege configurations, application allowlisting, anti-exploitation mitigations, and host-based intrusion detection/prevention to reduce risk from potential future exploitation.
Mentioned in this report
Detection guidance
Adobe Application Spawning Shell or Script Interpreter
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Adobe creative application (After Effects, Premiere Pro, Illustrator, Media Encoder, Substance 3D) spawning cmd.exe, powershell.exe, or cscript.exe - indicative of code execution via malicious file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Application Spawning Shell or Script Interpreter
description: Detects Adobe creative suite applications spawning command shells or
script interpreters, typical of exploitation via malicious document or project file.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \AfterFX.exe
- \Premiere.exe
- \Illustrator.exe
- \MediaEncoder.exe
- \Adobe Substance 3D Designer.exe
- \Adobe Substance 3D Painter.exe
- \Adobe Substance 3D Sampler.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \cscript.exe
- \wscript.exe
filter_adobe_legitimate:
CommandLine|contains:
- /s
- /c dir
- /c echo
condition: selection and not filter_adobe_legitimate
falsepositives:
- Adobe plugins or extensions launching scripts for legitimate automation
- IT deployment tools invoking Adobe via shell wrappers
level: high
id: 038cd77e-9bc1-5eab-bacf-b2941c1fc8c1
status: experimental
author: Vorant
Adobe Commerce/Magento Process Spawning Reverse Shell or Data Exfiltration Tool
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Adobe Commerce or Magento process spawning network utilities (curl, wget, nc) or shell interpreters indicating post-exploitation activity or server compromise. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Commerce/Magento Spawning Network or Shell Utility
description: Detects Adobe Commerce/Magento-related processes (PHP, Apache, nginx
parent) spawning network tools or interpreters following successful exploit.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \php.exe
- \php-cgi.exe
- \httpd.exe
- \nginx.exe
Image|endswith:
- \curl.exe
- \wget.exe
- \nc.exe
- \powershell.exe
- \cmd.exe
filter_legitimate_commerce:
CommandLine|contains:
- --version
- -h
- --help
condition: selection and not filter_legitimate_commerce
falsepositives:
- Commerce extensions legitimately invoking curl for payment gateway calls
- Magento backup or monitoring scripts using wget
level: medium
id: 393ed756-fe6d-5bef-9538-539c95ae6d1d
status: experimental
author: Vorant
Suspicious File Write from Adobe Application to System or Startup Directories
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Adobe application (creative suite or Commerce process) writing executable or script files to Windows startup, system directories, or AppData\Roaming\Run registry equivalent locations. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Application Writing to Startup or System Directories
description: Detects Adobe processes writing .exe, .dll, .vbs, .ps1 files to Windows
startup, System32, or user AppData locations following potential exploitation.
tags:
- attack.execution
- attack.persistence
- attack.t1203
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \AfterFX.exe
- \Premiere.exe
- \Illustrator.exe
- \MediaEncoder.exe
- \php.exe
- \php-cgi.exe
TargetFilename|contains:
- \System32\
- \SysWOW64\
- \AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
- \ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
TargetFilename|endswith:
- .exe
- .dll
- .vbs
- .ps1
- .scr
filter_adobe_updates:
TargetFilename|contains: Adobe
condition: selection and not filter_adobe_updates
falsepositives:
- Adobe plugin installers writing to AppData during setup
- Commerce platform legitimate file uploads in temp locations
level: high
id: 79174d0c-f12d-5e57-93c8-9e7529beb8e9
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-046
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs