# Adobe Acrobat/Reader zero-day exploited in wild

Published: 2021-05-11 · Severity: high
Canonical: https://vorant.io/reports/9be66382-a69c-5e3b-87da-6a3409cf7650/adobe-acrobat-reader-zero-day-exploited-in-wild

> Adobe patched an actively exploited use-after-free flaw (CVE-2021-28550) in Acrobat and Reader; IPA urges immediate updates.

Japan's IPA issued an alert regarding a vulnerability in Adobe Acrobat and Reader disclosed by Adobe under advisory APSB21-29. Adobe confirmed that CVE-2021-28550 has been exploited in the wild, prompting IPA to urge users to apply the patch immediately.

## Mentioned in this report

- Vulnerabilities: CVE-2021-28550 (KEV)

## Detection guidance (public sample)

### Adobe Acrobat/Reader Spawning Suspicious Child Process

ATT&CK: T1203

Detects Acrobat/Reader (Acrobat.exe, AcroRd32.exe) launching command interpreters or scripting engines, consistent with exploitation of a PDF-parsing vulnerability such as CVE-2021-28550. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Adobe Acrobat or Reader Spawning Command Interpreter
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \\Acrobat.exe
    - \\AcroRd32.exe
    - \\RdrCEF.exe
  selection_child:
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\wscript.exe
    - \\cscript.exe
    - \\mshta.exe
    - \\rundll32.exe
    - \\regsvr32.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate Acrobat plugins or update mechanisms invoking helper scripts
- Enterprise deployment tools that automate Acrobat via scripting
level: high
tags:
- attack.t1203
- attack.execution
id: 6aa03f3e-ec04-5c2a-9a28-b79a88a105b2
status: experimental
author: Vorant
```

### Adobe Acrobat/Reader Writing Executable or Script to Disk

ATT&CK: T1203

Detects Acrobat/Reader processes creating executable, DLL, or script files outside normal cache/temp update paths, which may indicate a dropped payload following exploitation of a PDF parsing vulnerability like CVE-2021-28550. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Adobe Acrobat or Reader Dropping Executable or Script File
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
    - \\Acrobat.exe
    - \\AcroRd32.exe
    - \\RdrCEF.exe
  selection_target:
    TargetFilename|endswith:
    - .exe
    - .dll
    - .ps1
    - .vbs
    - .js
    - .hta
  filter_update:
    TargetFilename|contains:
    - \\Adobe\\ARM\\
    - \\Adobe\\Acrobat\\
  condition: selection_image and selection_target and not filter_update
falsepositives:
- Adobe auto-update process legitimately writing new binaries during patching
- Third-party Acrobat plugins installing helper DLLs
level: medium
tags:
- attack.t1203
- attack.persistence
id: 79593330-3977-54ac-832b-699f693f7a34
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/20210512-adobereader.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9be66382-a69c-5e3b-87da-6a3409cf7650/adobe-acrobat-reader-zero-day-exploited-in-wild.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup