Adobe products patch arbitrary code execution flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Adobe patches multiple remote code execution vulnerabilities across Creative Cloud, ColdFusion, and Substance 3D products; no active exploitation reported.
CIS/MS-ISAC advisory 2026-005 documents a set of memory corruption and injection vulnerabilities across Adobe's product portfolio. The affected products include Bridge, Dreamweaver, InCopy, InDesign, Substance 3D (Designer, Modeler, Painter, Sampler, Stager), Illustrator, and ColdFusion. The most severe flaws involve heap-based buffer overflows, out-of-bounds read/write conditions, use-after-free, and OS command injection that could allow arbitrary code execution in the context of the logged-on user. ColdFusion is also affected by an XML External Entity (XXE) injection vulnerability in the bundled Apache Tika dependency. The advisory notes no current in-the-wild exploitation. Successful exploitation would grant an attacker capabilities including program installation, data access/modification, and account creation, with impact scaled to the victim user's privilege level.
Remediation requires immediate patching of all affected versions across the product lines. The advisory emphasizes vulnerability management processes, principle of least privilege, application allowlisting, and anti-exploitation features (DEP, WDEG, SIP). Organizations should prioritize ColdFusion instances and any Adobe applications handling untrusted file formats or exposed to network access, as these present the highest attack surface.
Mentioned in this report
Detection guidance
Adobe Desktop Application Spawning Command Shell or Script Host
Adobe creative applications (Illustrator, InDesign, InCopy, Bridge, Dreamweaver, Substance 3D) spawning cmd, PowerShell or script hosts, which suggests exploitation of a memory corruption or command injection flaw via a malicious file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Desktop Application Spawning Command Shell or Script Host
description: Detects Adobe creative applications spawning a command interpreter or
script host. Exploitation of heap overflow, use-after-free or OS command injection
flaws in these products via a crafted file would typically show up as this parent/child
relation. Generalises on the relation, not on any file name.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \Illustrator.exe
- \InDesign.exe
- \InCopy.exe
- \Bridge.exe
- \Dreamweaver.exe
selection_parent_substance:
ParentImage|contains: \Adobe Substance 3D
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
condition: 1 of selection_parent* and selection_child
falsepositives:
- Dreamweaver or Bridge extensions and build workflows that deliberately launch a
command prompt
- Adobe plugin or installer helper scripts launched from the application
level: high
id: 323d36a8-d35a-5ede-950d-730baca13dc0
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-005
Adobe Desktop Application Spawning LOLBin or Download Utility
Adobe creative applications spawning living-off-the-land binaries or download utilities, typical of post-exploitation payload staging after client-side code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Desktop Application Spawning LOLBin or Download Utility
description: Detects Adobe creative applications launching binaries commonly abused
to download or execute payloads (certutil, bitsadmin, rundll32, regsvr32, msiexec,
curl). Indicates possible post-exploitation after a file-format memory corruption
exploit.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \Illustrator.exe
- \InDesign.exe
- \InCopy.exe
- \Bridge.exe
- \Dreamweaver.exe
selection_parent_substance:
ParentImage|contains: \Adobe Substance 3D
selection_child:
Image|endswith:
- \certutil.exe
- \bitsadmin.exe
- \rundll32.exe
- \regsvr32.exe
- \msiexec.exe
- \curl.exe
filter_adobe_installer:
CommandLine|contains: \Adobe\Adobe Creative Cloud
condition: 1 of selection_parent* and selection_child and not filter_adobe_installer
falsepositives:
- Adobe plugin or extension installers invoking msiexec or rundll32
- Application-initiated rundll32 calls for printing or shell integration
level: medium
id: 85e46ab5-b74f-50c1-90e0-fbb8f31ed626
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-005
ColdFusion Service Spawning Shell or Reconnaissance Command
The ColdFusion server process spawning a shell or common recon/download utilities, consistent with OS command injection or other exploitation of the ColdFusion server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ColdFusion Service Spawning Shell or Reconnaissance Command
description: Detects the ColdFusion server process (coldfusion.exe) spawning command
interpreters or recon/download utilities. This is consistent with OS command injection
or code execution flaws in ColdFusion and its bundled components.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \coldfusion.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \whoami.exe
- \net.exe
- \net1.exe
- \certutil.exe
- \bitsadmin.exe
- \curl.exe
condition: selection
falsepositives:
- ColdFusion applications that intentionally use cfexecute to run batch files or admin
scripts
- Scheduled ColdFusion maintenance tasks invoking cmd.exe
level: high
id: a4515e76-7b9a-50e2-aa24-b8abfcea8a97
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-005
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-005
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs