Adobe patched CVE-2023-26369 in Acrobat/Reader after confirming active exploitation

Published12 September 2023 Vorant ratinghigh vulnerability

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Adobe patched CVE-2023-26369 in Acrobat/Reader after confirming active exploitation; IPA Japan urges immediate updates.

Sourceipa.go.jp — open the original

What to check

Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
Exploitation: CISA lists CVE-2023-26369 as exploited in the wild.

Japan's Information-technology Promotion Agency (IPA) issued a security alert on September 13, 2023, warning of actively exploited vulnerabilities in Adobe Acrobat and Reader products. The advisory references Adobe's security bulletin APSB23-34 and specifically highlights CVE-2023-26369, which Adobe confirmed is being exploited in the wild. The vulnerability affects Adobe Acrobat DC and Reader DC versions 23.003.20284 and earlier on both Windows and macOS, as well as Acrobat 2020 and Reader 2020 versions 20.005.30514/20.005.30516 and earlier.

IPA strongly recommends immediate patching, directing users to update to the latest versions provided by Adobe. The alert was published by IPA's Security Center and follows standard disclosure practices for critical vulnerabilities affecting widely deployed software in Japanese government and enterprise environments. Given the confirmed in-the-wild exploitation, organizations using affected Adobe products face immediate risk and should prioritize remediation.

Mentioned in this report

Vulnerabilities CVE-2023-26369KEV

Detection guidance

Suspicious Child Process Spawned by Adobe Acrobat/Reader

ATT&CK T1203 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects command shell or scripting interpreters spawned as children of Adobe Acrobat/Reader processes, consistent with exploitation of a memory-corruption vulnerability such as CVE-2023-26369 leading to code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process from Adobe Acrobat or Reader
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \Acrobat.exe
    - \AcroRd32.exe
    - \RdrCEF.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate Acrobat plugins or update mechanisms rarely spawn shells but some enterprise
  deployment/repair tools may trigger this
- Add-in or JavaScript-based automation workflows in some organizations
level: high
tags:
- attack.t1203
- cve.2023-26369
id: 8f59f99a-3eb4-58db-9858-97d82912a5c7
author: Vorant

Adobe Acrobat/Reader Writing Executable or Script Files to Disk

ATT&CK T1105 · status experimental · needs windows file_event logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects Adobe Acrobat/Reader processes writing executable or script files to disk, a behavior consistent with post-exploitation payload drop following exploitation of a PDF reader vulnerability like CVE-2023-26369. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Executable or Script File Dropped by Adobe Acrobat or Reader
status: experimental
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \Acrobat.exe
    - \AcroRd32.exe
    - \RdrCEF.exe
    TargetFilename|endswith:
    - .exe
    - .dll
    - .ps1
    - .vbs
    - .bat
    - .hta
  filter:
    TargetFilename|contains:
    - \Adobe\Acrobat\
    - \Adobe\Reader\
  condition: selection and not filter
falsepositives:
- Adobe's own update or plugin installation process writing files within its own installation
  directories
- Third-party PDF plugin installers
level: medium
tags:
- attack.t1105
- cve.2023-26369
id: f43fb744-7a5f-5b8b-977b-c3d6668bf250
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/0913-adobereader.html

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs