Adobe patches 60 vulnerabilities across 10 products
Adobe released patches for 60+ vulnerabilities across 10 product lines, including critical RCE flaws in After Effects, Premiere Pro, and Illustrator.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Adobe issued a comprehensive security update on May 12, 2026, addressing multiple vulnerabilities across its product portfolio including After Effects, Commerce, Connect, Media Encoder, Premiere Pro, Substance 3D suite, Content Authenticity SDK, and Illustrator. The most severe vulnerabilities enable arbitrary code execution through memory corruption flaws such as stack-based and heap-based buffer overflows, out-of-bounds write conditions, and use-after-free issues. Exploitation requires user interaction with maliciously crafted files in affected applications.
The Adobe Commerce platform is affected by authorization bypass, server-side request forgery, stored cross-site scripting, and path traversal vulnerabilities that could allow unauthorized access to sensitive data or administrative functions. Adobe Connect Desktop Application contains deserialization and authorization flaws. The Content Authenticity SDK suffers from multiple input validation and resource consumption issues that could lead to denial of service conditions.
MS-ISAC assesses these vulnerabilities pose a high risk to government and business environments, with lower impact to home users. No active exploitation has been reported in the wild. Organizations should prioritize patching media production software used in creative workflows and Commerce installations with internet-facing exposure. Successful exploitation depends on user privileges, with administrative accounts facing greater impact than restricted user accounts.
Mentioned in this report
Detection guidance
Adobe Creative/Commerce Application Spawning Shell or Script Interpreter (Possible Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects an Adobe product (After Effects, Premiere Pro, Illustrator, Media Encoder, Substance 3D, Connect) spawning a command interpreter or scripting engine, consistent with post-exploitation code execution after a user opens a maliciously crafted file exploiting a memory-corruption vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Application Spawning Command Interpreter
id: a7f147f1-31e6-5d4d-9cda-5f30b04dafda
status: experimental
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \AfterFX.exe
- \Premiere Pro.exe
- \Adobe Premiere Pro.exe
- \Illustrator.exe
- \AME.exe
- \Adobe Media Encoder.exe
- \Connect.exe
- \ConnectDesktop.exe
- \Adobe Substance 3D Painter.exe
- \Adobe Substance 3D Designer.exe
- \Adobe Substance 3D Sampler.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
condition: selection_parent and selection_child
falsepositives:
- Legitimate Adobe extension/plugin installers or update routines that invoke helper
scripts
- IT-deployed automation or macros interacting with Adobe applications via command
line
level: high
tags:
- attack.t1203
- attack.execution
author: Vorant
Adobe Application Crash Followed by Unsigned Process Creation (Possible Exploit Payload Execution)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a newly created unsigned or unusual child process from an Adobe creative application shortly after opening a document/media file, which may indicate successful exploitation of a memory corruption vulnerability leading to arbitrary code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unsigned Child Process from Adobe Media Production Application
id: 2cd0b971-b14c-5deb-985c-f999b8cb8600
status: experimental
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \AfterFX.exe
- \Premiere Pro.exe
- \Illustrator.exe
- \AME.exe
- \Adobe Media Encoder.exe
- \Adobe Substance 3D Painter.exe
- \Adobe Substance 3D Designer.exe
- \Adobe Substance 3D Sampler.exe
selection_child_path:
Image|contains:
- \Users\
- \AppData\
- \Temp\
filter_common:
Image|endswith:
- \CCXProcess.exe
- \Creative Cloud\
- \AdobeIPCBroker.exe
condition: selection_parent and selection_child_path and not filter_common
falsepositives:
- Adobe Creative Cloud helper and update processes launched from user profile paths
- Plugin or extension installers running from AppData during normal use
level: medium
tags:
- attack.t1203
- attack.execution
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-046
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs