Adobe patched CVE-2023-26369 in Acrobat/Reader after confirming active exploitation
Adobe patched CVE-2023-26369 in Acrobat/Reader after confirming active exploitation; IPA Japan urges immediate updates.
Japan's Information-technology Promotion Agency (IPA) issued a security alert on September 13, 2023, warning of actively exploited vulnerabilities in Adobe Acrobat and Reader products. The advisory references Adobe's security bulletin APSB23-34 and specifically highlights CVE-2023-26369, which Adobe confirmed is being exploited in the wild. The vulnerability affects Adobe Acrobat DC and Reader DC versions 23.003.20284 and earlier on both Windows and macOS, as well as Acrobat 2020 and Reader 2020 versions 20.005.30514/20.005.30516 and earlier.
IPA strongly recommends immediate patching, directing users to update to the latest versions provided by Adobe. The alert was published by IPA's Security Center and follows standard disclosure practices for critical vulnerabilities affecting widely deployed software in Japanese government and enterprise environments. Given the confirmed in-the-wild exploitation, organizations using affected Adobe products face immediate risk and should prioritize remediation.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Adobe Acrobat/Reader
Detects command shell or scripting interpreters spawned as children of Adobe Acrobat/Reader processes, consistent with exploitation of a memory-corruption vulnerability such as CVE-2023-26369 leading to code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process from Adobe Acrobat or Reader
status: experimental
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \Acrobat.exe
- \AcroRd32.exe
- \RdrCEF.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection_parent and selection_child
falsepositives:
- Legitimate Acrobat plugins or update mechanisms rarely spawn shells but some enterprise
deployment/repair tools may trigger this
- Add-in or JavaScript-based automation workflows in some organizations
level: high
tags:
- attack.t1203
- cve.2023-26369
id: 8f59f99a-3eb4-58db-9858-97d82912a5c7
author: Vorant
Adobe Acrobat/Reader Writing Executable or Script Files to Disk
Detects Adobe Acrobat/Reader processes writing executable or script files to disk, a behavior consistent with post-exploitation payload drop following exploitation of a PDF reader vulnerability like CVE-2023-26369. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Executable or Script File Dropped by Adobe Acrobat or Reader
status: experimental
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \Acrobat.exe
- \AcroRd32.exe
- \RdrCEF.exe
TargetFilename|endswith:
- .exe
- .dll
- .ps1
- .vbs
- .bat
- .hta
filter:
TargetFilename|contains:
- \Adobe\Acrobat\
- \Adobe\Reader\
condition: selection and not filter
falsepositives:
- Adobe's own update or plugin installation process writing files within its own installation
directories
- Third-party PDF plugin installers
level: medium
tags:
- attack.t1105
- cve.2023-26369
id: f43fb744-7a5f-5b8b-977b-c3d6668bf250
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/0913-adobereader.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free