# Multiple Adobe products vulnerable to arbitrary code execution

Published: 2026-04-14 · Severity: routine · Sectors: technology, defense, government-national, education, financial-services, healthcare
Canonical: https://vorant.io/reports/85504e03-a5c2-5194-b0e0-4e2670477c9f/multiple-adobe-products-vulnerable-to-arbitrary-code-execution

> Multiple critical vulnerabilities across Adobe products could enable arbitrary code execution; no active exploitation reported yet.

CIS issued advisory 2026-034 detailing multiple vulnerabilities affecting 11 Adobe products including Acrobat Reader, InDesign, InCopy, Experience Manager Screens, FrameMaker, Connect, ColdFusion, Bridge, Photoshop, DNG SDK, and Illustrator. The most severe vulnerabilities enable arbitrary code execution in the context of the logged-on user, with impact dependent on user privilege level. Exploitation could allow attackers to install programs, modify or delete data, or create new accounts with elevated rights. Vulnerability types include prototype pollution, use-after-free, buffer overflows, out-of-bounds read/write, cross-site scripting, deserialization flaws, path traversal, and type confusion errors. The advisory reports no current in-the-wild exploitation. Affected versions span multiple release cycles for each product, with updates available on the stable channel.

## Mentioned in this report

- Vulnerabilities: CVE-2026-21331, CVE-2026-27226, CVE-2026-27238, CVE-2026-27243, CVE-2026-27245, CVE-2026-27246, CVE-2026-27261, CVE-2026-27263, CVE-2026-27264, CVE-2026-27283, CVE-2026-27284, CVE-2026-27285, CVE-2026-27286, CVE-2026-27287, CVE-2026-27288, CVE-2026-27290, CVE-2026-27291, CVE-2026-27292, CVE-2026-27293, CVE-2026-27294, CVE-2026-27295, CVE-2026-27296, CVE-2026-27297, CVE-2026-27298, CVE-2026-27299, CVE-2026-27300, CVE-2026-27301, CVE-2026-27302, CVE-2026-27303, CVE-2026-27304, CVE-2026-27305, CVE-2026-34614, CVE-2026-34615, CVE-2026-34617, CVE-2026-34619, CVE-2026-34622, CVE-2026-34623, CVE-2026-34624, CVE-2026-34625, CVE-2026-34626

## Detection guidance (public sample)

### Adobe Acrobat/Reader Spawning Script Interpreter or LOLBin

ATT&CK: T1203

Acrobat or Reader launching a shell, script host or download/proxy-execution binary, a common post-exploitation pattern after a malicious PDF triggers a memory-corruption or logic bug. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Adobe Acrobat/Reader Spawning Script Interpreter or LOLBin
description: Detects Acrobat or Acrobat Reader spawning command interpreters, script
  hosts or common proxy-execution/download binaries. This is a typical post-exploitation
  pattern after client-side exploitation of a malicious PDF. Based on the generic
  behaviour of arbitrary code execution in the user context, not on a specific CVE.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \AcroRd32.exe
    - \Acrobat.exe
    - \AcroRd64.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \regsvr32.exe
    - \rundll32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
  condition: selection
falsepositives:
- Acrobat plugins or enterprise document workflow tools that legitimately invoke cmd.exe
  or rundll32.exe
- Acrobat updater or installer actions that call msiexec.exe
level: high
id: d94bbca4-9d32-5001-bec4-1dc7f1a6e249
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-034
```

### Adobe Creative Application Spawning Shell or Script Host

ATT&CK: T1203

Photoshop, Illustrator, InDesign, InCopy, Bridge or FrameMaker spawning a shell or script host, which may indicate exploitation of a crafted document or image file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Adobe Creative Application Spawning Shell or Script Host
description: Detects Adobe desktop publishing and creative applications (Photoshop,
  Illustrator, InDesign, InCopy, Bridge, FrameMaker) spawning command shells or script
  hosts. Opening a crafted file that triggers memory corruption can lead to code execution
  in the user context and a child process like this.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \Photoshop.exe
    - \Illustrator.exe
    - \InDesign.exe
    - \InCopy.exe
    - \Bridge.exe
    - \FrameMaker.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Scripted production pipelines or plugins that call cmd.exe or PowerShell from Photoshop,
  InDesign or Bridge
- Installers for Adobe extensions launched from within the application
level: medium
id: b1d49d9a-97c1-5599-a09f-6d85e091417b
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-034
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-034

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/85504e03-a5c2-5194-b0e0-4e2670477c9f/multiple-adobe-products-vulnerable-to-arbitrary-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup