Multiple Adobe products patched for arbitrary code execution

MS-ISAC advisory 2026-067 reports multiple vulnerabilities across Adobe Creative Cloud, ColdFusion, Commerce, and Experience Manager that could allow arbitrary code execution; no active exploitation reported.

MS-ISAC has published a coordinated vulnerability advisory covering multiple critical and high-severity vulnerabilities across a broad range of Adobe products. The most severe issues affect Adobe creative applications (After Effects, Animate, Audition, Bridge, Illustrator, Media Encoder, Premiere Pro), enterprise platforms (ColdFusion, Commerce, Experience Manager), and developer toolkits (Content Credentials SDK, Creative Cloud Desktop). Vulnerability classes span memory corruption (out-of-bounds writes, buffer overflows), authorization bypass, path traversal, OS command injection, and web-based flaws (XSS, SSRF, XXE). Successful exploitation of the most severe vulnerabilities could result in arbitrary code execution in the context of the logged-on user, allowing an attacker to install programs, modify data, or create accounts with user privileges.

The advisory specifies affected versions across all products and notes there are currently no reports of in-the-wild exploitation. Adobe has released stable channel updates to address these issues. Defenders should prioritize patching based on deployed products and user privilege levels, with particular attention to systems running administrative users. Mitigation strategies include application of vendor patches, privilege restriction to non-administrative accounts, application allowlisting, anti-exploitation controls, and network filtering.

title: Adobe Application Spawning Command Interpreter or Script Host
description: Detects Adobe creative, enterprise, or developer products spawning command-line
  interpreters or script hosts. Exploitation of memory corruption or injection vulnerabilities
  in these applications may result in arbitrary code execution that attempts shell
  access.
tags:
- attack.t1203
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \AfterFX.exe
    - \Animate.exe
    - \Audition.exe
    - \Bridge.exe
    - \Illustrator.exe
    - \MediaEncoder.exe
    - \Premiere.exe
    - \cfusion.exe
    - \java.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate Adobe scripts or plugins that invoke batch/PowerShell commands
- IT deployment scripts running from Adobe applications
level: high
id: edaa44b0-bc96-559b-a855-625c77e580ce
status: experimental
author: Vorant

title: Adobe Application Loading Suspicious DLL
description: Detects Adobe creative, enterprise, or developer applications loading
  DLLs from user-writable or non-standard locations. DLL hijacking and path traversal
  vulnerabilities may allow attackers to load malicious libraries in the context of
  the Adobe process.
tags:
- attack.t1574.001
- attack.privilege-escalation
logsource:
  category: image_load
  product: windows
detection:
  selection_image:
    Image|endswith:
    - \AfterFX.exe
    - \Animate.exe
    - \Audition.exe
    - \Bridge.exe
    - \Illustrator.exe
    - \MediaEncoder.exe
    - \Premiere.exe
    - \cfusion.exe
  selection_path:
    ImageLoaded|contains:
    - \AppData\Local\Temp\
    - \AppData\Roaming\
    - \Downloads\
    - \Temp\
  condition: selection_image and selection_path
falsepositives:
- Legitimate third-party Adobe plugins installed in AppData
- Adobe cache or temporary files loaded during normal operation
level: medium
id: 6b864b3c-7fca-574a-b4a9-0c2a30411991
status: experimental
author: Vorant

title: Adobe ColdFusion/Experience Manager Remote Command Execution Attempt
description: Detects web requests to Adobe ColdFusion or Experience Manager endpoints
  with patterns consistent with OS command injection, XXE, SSRF, or path traversal
  exploitation. These vulnerabilities may allow unauthenticated remote code execution.
tags:
- attack.t1190
- attack.initial-access
logsource:
  category: proxy
  product: proxy
detection:
  selection_host:
    DestinationHostname|contains:
    - coldfusion
    - experience_manager
    - aem
  selection_payload:
    RequestString|contains:
    - cmd=
    - exec=
    - system(
    - <![CDATA[
    - file://
    - gopher://
    - ../../../../
    - ..\..\..\..\windows\
  condition: selection_host and selection_payload
falsepositives:
- Legitimate administrative requests containing similar keywords
- Vulnerability scanning and penetration testing activity
level: high
id: 3e607c96-94ce-5600-8e65-54bd027792d8
status: experimental
author: Vorant

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-067