Adobe Bridge, Format Plugins get RCE patches
Adobe patched multiple code-execution vulnerabilities in Bridge and Format Plugins; no in-the-wild exploitation reported.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 9 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Adobe has disclosed multiple vulnerabilities affecting Adobe Bridge and Adobe Format Plugins that could lead to arbitrary code execution in the context of the logged-on user. The flaws include untrusted search path issues, incorrect authorization, path traversal, out-of-bounds write conditions, and a heap-based buffer overflow, spanning Adobe Bridge versions 15.1.6 (LTS) and earlier, 16.0.5 and earlier, and Adobe Format Plugins 2026.05 and earlier.
Exploitation would allow an attacker to execute code with the privileges of the logged-in user, potentially enabling installation of programs, data manipulation, or creation of new accounts, with impact scaled to the user's privilege level. MS-ISAC notes there are currently no reports of these vulnerabilities being exploited in the wild. Organizations are advised to apply Adobe's stable channel updates after testing and to implement standard mitigations such as least privilege, application allowlisting, and exploit protection features.
Mentioned in this report
Detection guidance
Adobe Bridge or Format Plugins Spawning Unusual Child Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Adobe Bridge or Format Plugin host processes spawning shells or scripting interpreters, consistent with post-exploitation code execution following an RCE in Adobe Bridge/Format Plugins. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Bridge or Format Plugins Spawning Unusual Child Process
description: Adobe Bridge and its Format Plugins normally do not spawn command shells,
scripting engines, or LOLBins. Such a child process shortly after Bridge/Format
Plugin activity is consistent with exploitation of a client-execution vulnerability
(untrusted search path, path traversal, OOB write, heap overflow) leading to arbitrary
code execution in the user's context.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \Bridge.exe
- \FormatPlugins.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
filter_updater:
CommandLine|contains:
- AdobeUpdater
- AdobeARM
condition: selection and not filter_updater
falsepositives:
- Adobe update or repair routines that legitimately invoke helper scripts or rundll32
- Third-party Bridge extensions that shell out to command-line tools
level: medium
id: b510a5f2-12a0-53ad-8243-9413c1d9bc64
status: experimental
author: Vorant
Adobe Bridge Loading DLL From Non-Standard Writable Path
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Adobe Bridge loading a DLL from a user-writable or non-installation directory, indicative of exploitation of an untrusted search path vulnerability enabling DLL side-loading. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Bridge Loading DLL From Non-Standard Writable Path
description: Adobe Bridge is affected by an untrusted search path vulnerability that
can allow a malicious DLL placed in an attacker-controlled or user-writable directory
to be loaded instead of the legitimate library. This rule looks for Bridge.exe loading
modules from locations outside its normal Program Files installation path, such
as Temp, Downloads, AppData, or removable/network drives.
tags:
- attack.execution
- attack.t1203
logsource:
category: image_load
product: windows
detection:
selection:
Image|endswith: \Bridge.exe
ImageLoaded|endswith: .dll
suspicious_path:
ImageLoaded|contains:
- \AppData\Local\Temp
- \Downloads\
- \Users\Public\
- \ProgramData\
filter_legit:
ImageLoaded|contains:
- \Program Files\Adobe\
- \Program Files (x86)\Adobe\
- \Windows\System32\
- \Windows\SysWOW64\
condition: selection and suspicious_path and not filter_legit
falsepositives:
- Bridge extensions or third-party plugins installed under user profile paths
- Portable/test installations of Adobe Bridge running from Temp or Downloads
level: medium
id: 5b01dbcf-7552-5f0d-9fa2-a599f36eee51
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-073
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs