# Adobe patched CVE-2023-26369 in Acrobat/Reader after confirming active exploitation

Published: 2023-09-12 · Severity: critical
Canonical: https://vorant.io/reports/bcdcb898-61f5-45d5-9ceb-da652b196d71/adobe-patched-cve-2023-26369-in-acrobat-reader-after-confirming-active

> Adobe patched CVE-2023-26369 in Acrobat/Reader after confirming active exploitation; IPA Japan urges immediate updates.

Japan's Information-technology Promotion Agency (IPA) issued a security alert on September 13, 2023, warning of actively exploited vulnerabilities in Adobe Acrobat and Reader products. The advisory references Adobe's security bulletin APSB23-34 and specifically highlights CVE-2023-26369, which Adobe confirmed is being exploited in the wild. The vulnerability affects Adobe Acrobat DC and Reader DC versions 23.003.20284 and earlier on both Windows and macOS, as well as Acrobat 2020 and Reader 2020 versions 20.005.30514/20.005.30516 and earlier.

IPA strongly recommends immediate patching, directing users to update to the latest versions provided by Adobe. The alert was published by IPA's Security Center and follows standard disclosure practices for critical vulnerabilities affecting widely deployed software in Japanese government and enterprise environments. Given the confirmed in-the-wild exploitation, organizations using affected Adobe products face immediate risk and should prioritize remediation.

## Mentioned in this report

- Vulnerabilities: CVE-2023-26369 (KEV)

## Detection guidance (public sample)

### Suspicious Child Process Spawned by Adobe Acrobat/Reader

ATT&CK: T1203

Detects command shell or scripting interpreters spawned as children of Adobe Acrobat/Reader processes, consistent with exploitation of a memory-corruption vulnerability such as CVE-2023-26369 leading to code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process from Adobe Acrobat or Reader
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \Acrobat.exe
    - \AcroRd32.exe
    - \RdrCEF.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate Acrobat plugins or update mechanisms rarely spawn shells but some enterprise
  deployment/repair tools may trigger this
- Add-in or JavaScript-based automation workflows in some organizations
level: high
tags:
- attack.t1203
- cve.2023-26369
id: 8f59f99a-3eb4-58db-9858-97d82912a5c7
author: Vorant
```

### Adobe Acrobat/Reader Writing Executable or Script Files to Disk

ATT&CK: T1105

Detects Adobe Acrobat/Reader processes writing executable or script files to disk, a behavior consistent with post-exploitation payload drop following exploitation of a PDF reader vulnerability like CVE-2023-26369. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Executable or Script File Dropped by Adobe Acrobat or Reader
status: experimental
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \Acrobat.exe
    - \AcroRd32.exe
    - \RdrCEF.exe
    TargetFilename|endswith:
    - .exe
    - .dll
    - .ps1
    - .vbs
    - .bat
    - .hta
  filter:
    TargetFilename|contains:
    - \Adobe\Acrobat\
    - \Adobe\Reader\
  condition: selection and not filter
falsepositives:
- Adobe's own update or plugin installation process writing files within its own installation
  directories
- Third-party PDF plugin installers
level: medium
tags:
- attack.t1105
- cve.2023-26369
id: f43fb744-7a5f-5b8b-977b-c3d6668bf250
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/0913-adobereader.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/bcdcb898-61f5-45d5-9ceb-da652b196d71/adobe-patched-cve-2023-26369-in-acrobat-reader-after-confirming-active.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup