Multiple Adobe products patched for arbitrary code execution
MS-ISAC advisory 2026-067 reports multiple vulnerabilities across Adobe Creative Cloud, ColdFusion, Commerce, and Experience Manager that could allow arbitrary code execution; no active exploitation reported.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 39 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-48356 as exploited in the wild.
MS-ISAC has published a coordinated vulnerability advisory covering multiple critical and high-severity vulnerabilities across a broad range of Adobe products. The most severe issues affect Adobe creative applications (After Effects, Animate, Audition, Bridge, Illustrator, Media Encoder, Premiere Pro), enterprise platforms (ColdFusion, Commerce, Experience Manager), and developer toolkits (Content Credentials SDK, Creative Cloud Desktop). Vulnerability classes span memory corruption (out-of-bounds writes, buffer overflows), authorization bypass, path traversal, OS command injection, and web-based flaws (XSS, SSRF, XXE). Successful exploitation of the most severe vulnerabilities could result in arbitrary code execution in the context of the logged-on user, allowing an attacker to install programs, modify data, or create accounts with user privileges.
The advisory specifies affected versions across all products and notes there are currently no reports of in-the-wild exploitation. Adobe has released stable channel updates to address these issues. Defenders should prioritize patching based on deployed products and user privilege levels, with particular attention to systems running administrative users. Mitigation strategies include application of vendor patches, privilege restriction to non-administrative accounts, application allowlisting, anti-exploitation controls, and network filtering.
Mentioned in this report
Detection guidance
Adobe Application Spawning Command Interpreter or Script Host
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Adobe creative/enterprise applications (After Effects, Animate, Audition, Bridge, Illustrator, Media Encoder, Premiere Pro, ColdFusion, Commerce, Experience Manager) spawning cmd.exe, powershell.exe, or cscript.exe - indicative of post-exploitation code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Application Spawning Command Interpreter or Script Host
description: Detects Adobe creative, enterprise, or developer products spawning command-line
interpreters or script hosts. Exploitation of memory corruption or injection vulnerabilities
in these applications may result in arbitrary code execution that attempts shell
access.
tags:
- attack.t1203
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \AfterFX.exe
- \Animate.exe
- \Audition.exe
- \Bridge.exe
- \Illustrator.exe
- \MediaEncoder.exe
- \Premiere.exe
- \cfusion.exe
- \java.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \cscript.exe
- \wscript.exe
condition: selection_parent and selection_child
falsepositives:
- Legitimate Adobe scripts or plugins that invoke batch/PowerShell commands
- IT deployment scripts running from Adobe applications
level: high
id: edaa44b0-bc96-559b-a855-625c77e580ce
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-067
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs