Adobe Patches Dozens of Code-Execution Flaws
Adobe released fixes for over 100 vulnerabilities across Connect, Experience Manager, Photoshop, Premiere and other products enabling arbitrary code execution; no active exploitation reported.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 35 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
MS-ISAC issued an advisory summarizing a large Adobe patch release covering Adobe Connect, Experience Manager (AEM and AEM Cloud Service), After Effects, Photoshop, the Content Credentials/C2PA SDK, Audition, Premiere, Media Encoder, and Dimension. The vulnerabilities span a wide range of weakness classes including SSRF, path traversal, SQL injection, code injection, stored/DOM/reflected XSS, heap and stack buffer overflows, out-of-bounds read/write, use-after-free, NULL pointer dereference, broken cryptographic algorithms, improper certificate/signature validation, and missing authentication. The most severe issues could allow arbitrary code execution, which combined with administrative privileges could let an attacker install programs, manipulate or delete data, or create new privileged accounts.
MS-ISAC states there are currently no reports of in-the-wild exploitation for any of these vulnerabilities. The advisory maps the exploitation technique to MITRE ATT&CK T1203 (Exploitation for Client Execution) under the Initial Access tactic, suggesting the primary risk vector is a user opening a malicious file or interacting with a vulnerable client application rather than remote unauthenticated network exploitation in most cases.
Defenders running any of the affected Adobe products should prioritize patching per Adobe's published updates, especially for Adobe Connect and AEM given the presence of SQL injection, code injection, and SSRF issues that could be remotely exploitable. Standard mitigations apply: least-privilege execution, network segmentation for Connect/AEM server deployments, vulnerability scanning, and monthly patch cadence given the volume of affected components.
Mentioned in this report
Detection guidance
Adobe Creative Application Spawning Shell or Script Interpreter
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Adobe creative apps (Photoshop, After Effects, Premiere, Audition, Media Encoder, Dimension) spawning shells, script hosts or LOLBins, a sign of client-side exploitation via a malicious file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Creative Application Spawning Shell or Script Interpreter
description: Detects Adobe client applications named in the patch advisory (Photoshop,
After Effects, Premiere, Audition, Media Encoder, Dimension) spawning command shells,
script hosts or common download/execute LOLBins. This is typical post-exploitation
behaviour after a malicious file triggers a memory-corruption or code-injection
flaw (T1203). Matches the parent/child relation, not a specific CVE or file.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \Photoshop.exe
- \AfterFX.exe
- \Adobe Premiere Pro.exe
- \Adobe Audition.exe
- \Adobe Media Encoder.exe
- \Dimension.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \regsvr32.exe
- \rundll32.exe
- \certutil.exe
- \bitsadmin.exe
- \msiexec.exe
- \wmic.exe
condition: selection_parent and selection_child
falsepositives:
- Studio automation or third-party plugins and scripts that launch cmd.exe or PowerShell
from Photoshop or After Effects
- Adobe installer or updater helpers invoking msiexec from the application
level: medium
id: b71127ec-cf5c-513a-95a9-904860b245af
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-130
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-130
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs