# Adobe Patches Dozens of Code-Execution Flaws

Published: 2026-11-10 · Severity: routine
Canonical: https://vorant.io/reports/984928d9-9382-5e78-aec8-aa8c639d5c45/adobe-patches-dozens-of-code-execution-flaws
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Adobe released fixes for over 100 vulnerabilities across Connect, Experience Manager, Photoshop, Premiere and other products enabling arbitrary code execution; no active exploitation reported.

Source: cisecurity.org — https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-130

## What to check

- Applies to: The 35 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

MS-ISAC issued an advisory summarizing a large Adobe patch release covering Adobe Connect, Experience Manager (AEM and AEM Cloud Service), After Effects, Photoshop, the Content Credentials/C2PA SDK, Audition, Premiere, Media Encoder, and Dimension. The vulnerabilities span a wide range of weakness classes including SSRF, path traversal, SQL injection, code injection, stored/DOM/reflected XSS, heap and stack buffer overflows, out-of-bounds read/write, use-after-free, NULL pointer dereference, broken cryptographic algorithms, improper certificate/signature validation, and missing authentication. The most severe issues could allow arbitrary code execution, which combined with administrative privileges could let an attacker install programs, manipulate or delete data, or create new privileged accounts.

MS-ISAC states there are currently no reports of in-the-wild exploitation for any of these vulnerabilities. The advisory maps the exploitation technique to MITRE ATT&CK T1203 (Exploitation for Client Execution) under the Initial Access tactic, suggesting the primary risk vector is a user opening a malicious file or interacting with a vulnerable client application rather than remote unauthenticated network exploitation in most cases.

Defenders running any of the affected Adobe products should prioritize patching per Adobe's published updates, especially for Adobe Connect and AEM given the presence of SQL injection, code injection, and SSRF issues that could be remotely exploitable. Standard mitigations apply: least-privilege execution, network segmentation for Connect/AEM server deployments, vulnerability scanning, and monthly patch cadence given the volume of affected components.

## Mentioned in this report

- Vulnerabilities: CVE-2026-110087, CVE-2026-110088, CVE-2026-110089, CVE-2026-110091, CVE-2026-113512, CVE-2026-113530, CVE-2026-113536, CVE-2026-113538, CVE-2026-113545, CVE-2026-113547, CVE-2026-113551, CVE-2026-113565, CVE-2026-113567, CVE-2026-113572, CVE-2026-113575, CVE-2026-113579, CVE-2026-113580, CVE-2026-114371, CVE-2026-114373, CVE-2026-116480, CVE-2026-117546, CVE-2026-117547, CVE-2026-118482, CVE-2026-118483, CVE-2026-121351, CVE-2026-121352, CVE-2026-121356, CVE-2026-121892, CVE-2026-121894, CVE-2026-122098, CVE-2026-123262, CVE-2026-123263, CVE-2026-123267, CVE-2026-48402, CVE-2026-82002

## Detection guidance (public sample)

### Adobe Creative Application Spawning Shell or Script Interpreter

ATT&CK: T1203

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Adobe creative apps (Photoshop, After Effects, Premiere, Audition, Media Encoder, Dimension) spawning shells, script hosts or LOLBins, a sign of client-side exploitation via a malicious file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Adobe Creative Application Spawning Shell or Script Interpreter
description: Detects Adobe client applications named in the patch advisory (Photoshop,
  After Effects, Premiere, Audition, Media Encoder, Dimension) spawning command shells,
  script hosts or common download/execute LOLBins. This is typical post-exploitation
  behaviour after a malicious file triggers a memory-corruption or code-injection
  flaw (T1203). Matches the parent/child relation, not a specific CVE or file.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \Photoshop.exe
    - \AfterFX.exe
    - \Adobe Premiere Pro.exe
    - \Adobe Audition.exe
    - \Adobe Media Encoder.exe
    - \Dimension.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \regsvr32.exe
    - \rundll32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
    - \wmic.exe
  condition: selection_parent and selection_child
falsepositives:
- Studio automation or third-party plugins and scripts that launch cmd.exe or PowerShell
  from Photoshop or After Effects
- Adobe installer or updater helpers invoking msiexec from the application
level: medium
id: b71127ec-cf5c-513a-95a9-904860b245af
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-130
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-130

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/984928d9-9382-5e78-aec8-aa8c639d5c45/adobe-patches-dozens-of-code-execution-flaws.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup