Multiple Adobe products vulnerable to arbitrary code execution
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple critical vulnerabilities across Adobe products could enable arbitrary code execution; no active exploitation reported yet.
CIS issued advisory 2026-034 detailing multiple vulnerabilities affecting 11 Adobe products including Acrobat Reader, InDesign, InCopy, Experience Manager Screens, FrameMaker, Connect, ColdFusion, Bridge, Photoshop, DNG SDK, and Illustrator. The most severe vulnerabilities enable arbitrary code execution in the context of the logged-on user, with impact dependent on user privilege level. Exploitation could allow attackers to install programs, modify or delete data, or create new accounts with elevated rights. Vulnerability types include prototype pollution, use-after-free, buffer overflows, out-of-bounds read/write, cross-site scripting, deserialization flaws, path traversal, and type confusion errors. The advisory reports no current in-the-wild exploitation. Affected versions span multiple release cycles for each product, with updates available on the stable channel.
Mentioned in this report
Detection guidance
Adobe Acrobat/Reader Spawning Script Interpreter or LOLBin
Acrobat or Reader launching a shell, script host or download/proxy-execution binary, a common post-exploitation pattern after a malicious PDF triggers a memory-corruption or logic bug. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Acrobat/Reader Spawning Script Interpreter or LOLBin
description: Detects Acrobat or Acrobat Reader spawning command interpreters, script
hosts or common proxy-execution/download binaries. This is a typical post-exploitation
pattern after client-side exploitation of a malicious PDF. Based on the generic
behaviour of arbitrary code execution in the user context, not on a specific CVE.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \AcroRd32.exe
- \Acrobat.exe
- \AcroRd64.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \regsvr32.exe
- \rundll32.exe
- \certutil.exe
- \bitsadmin.exe
- \msiexec.exe
condition: selection
falsepositives:
- Acrobat plugins or enterprise document workflow tools that legitimately invoke cmd.exe
or rundll32.exe
- Acrobat updater or installer actions that call msiexec.exe
level: high
id: d94bbca4-9d32-5001-bec4-1dc7f1a6e249
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-034
Adobe Creative Application Spawning Shell or Script Host
Photoshop, Illustrator, InDesign, InCopy, Bridge or FrameMaker spawning a shell or script host, which may indicate exploitation of a crafted document or image file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Creative Application Spawning Shell or Script Host
description: Detects Adobe desktop publishing and creative applications (Photoshop,
Illustrator, InDesign, InCopy, Bridge, FrameMaker) spawning command shells or script
hosts. Opening a crafted file that triggers memory corruption can lead to code execution
in the user context and a child process like this.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \Photoshop.exe
- \Illustrator.exe
- \InDesign.exe
- \InCopy.exe
- \Bridge.exe
- \FrameMaker.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Scripted production pipelines or plugins that call cmd.exe or PowerShell from Photoshop,
InDesign or Bridge
- Installers for Adobe extensions launched from within the application
level: medium
id: b1d49d9a-97c1-5599-a09f-6d85e091417b
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-034
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-034
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs