# Adobe products patch arbitrary code execution flaws Published: 2026-01-14 · Severity: high Canonical: https://vorant.io/reports/c52b270e-15b1-5a30-966b-6061473d7144/adobe-products-patch-arbitrary-code-execution-flaws > Adobe patches multiple remote code execution vulnerabilities across Creative Cloud, ColdFusion, and Substance 3D products; no active exploitation reported. CIS/MS-ISAC advisory 2026-005 documents a set of memory corruption and injection vulnerabilities across Adobe's product portfolio. The affected products include Bridge, Dreamweaver, InCopy, InDesign, Substance 3D (Designer, Modeler, Painter, Sampler, Stager), Illustrator, and ColdFusion. The most severe flaws involve heap-based buffer overflows, out-of-bounds read/write conditions, use-after-free, and OS command injection that could allow arbitrary code execution in the context of the logged-on user. ColdFusion is also affected by an XML External Entity (XXE) injection vulnerability in the bundled Apache Tika dependency. The advisory notes no current in-the-wild exploitation. Successful exploitation would grant an attacker capabilities including program installation, data access/modification, and account creation, with impact scaled to the victim user's privilege level. Remediation requires immediate patching of all affected versions across the product lines. The advisory emphasizes vulnerability management processes, principle of least privilege, application allowlisting, and anti-exploitation features (DEP, WDEG, SIP). Organizations should prioritize ColdFusion instances and any Adobe applications handling untrusted file formats or exposed to network access, as these present the highest attack surface. ## Mentioned in this report - Vulnerabilities: CVE-2025-66516 (weaponized), CVE-2026-21267, CVE-2026-21268, CVE-2026-21271, CVE-2026-21272, CVE-2026-21274, CVE-2026-21275, CVE-2026-21276, CVE-2026-21277, CVE-2026-21278, CVE-2026-21280, CVE-2026-21281, CVE-2026-21283, CVE-2026-21287, CVE-2026-21288, CVE-2026-21298, CVE-2026-21299, CVE-2026-21300, CVE-2026-21301, CVE-2026-21302, CVE-2026-21303, CVE-2026-21304, CVE-2026-21305, CVE-2026-21306, CVE-2026-21308 ## Detection guidance (public sample) ### Adobe Desktop Application Spawning Command Shell or Script Host ATT&CK: T1203 Adobe creative applications (Illustrator, InDesign, InCopy, Bridge, Dreamweaver, Substance 3D) spawning cmd, PowerShell or script hosts, which suggests exploitation of a memory corruption or command injection flaw via a malicious file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Adobe Desktop Application Spawning Command Shell or Script Host description: Detects Adobe creative applications spawning a command interpreter or script host. Exploitation of heap overflow, use-after-free or OS command injection flaws in these products via a crafted file would typically show up as this parent/child relation. Generalises on the relation, not on any file name. tags: - attack.execution - attack.t1203 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \Illustrator.exe - \InDesign.exe - \InCopy.exe - \Bridge.exe - \Dreamweaver.exe selection_parent_substance: ParentImage|contains: \Adobe Substance 3D selection_child: Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wscript.exe - \cscript.exe - \mshta.exe condition: 1 of selection_parent* and selection_child falsepositives: - Dreamweaver or Bridge extensions and build workflows that deliberately launch a command prompt - Adobe plugin or installer helper scripts launched from the application level: high id: 323d36a8-d35a-5ede-950d-730baca13dc0 status: experimental author: Vorant references: - https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-005 ``` ### Adobe Desktop Application Spawning LOLBin or Download Utility ATT&CK: T1203 Adobe creative applications spawning living-off-the-land binaries or download utilities, typical of post-exploitation payload staging after client-side code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Adobe Desktop Application Spawning LOLBin or Download Utility description: Detects Adobe creative applications launching binaries commonly abused to download or execute payloads (certutil, bitsadmin, rundll32, regsvr32, msiexec, curl). Indicates possible post-exploitation after a file-format memory corruption exploit. tags: - attack.execution - attack.t1203 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \Illustrator.exe - \InDesign.exe - \InCopy.exe - \Bridge.exe - \Dreamweaver.exe selection_parent_substance: ParentImage|contains: \Adobe Substance 3D selection_child: Image|endswith: - \certutil.exe - \bitsadmin.exe - \rundll32.exe - \regsvr32.exe - \msiexec.exe - \curl.exe filter_adobe_installer: CommandLine|contains: \Adobe\Adobe Creative Cloud condition: 1 of selection_parent* and selection_child and not filter_adobe_installer falsepositives: - Adobe plugin or extension installers invoking msiexec or rundll32 - Application-initiated rundll32 calls for printing or shell integration level: medium id: 85e46ab5-b74f-50c1-90e0-fbb8f31ed626 status: experimental author: Vorant references: - https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-005 ``` ### ColdFusion Service Spawning Shell or Reconnaissance Command ATT&CK: T1203 The ColdFusion server process spawning a shell or common recon/download utilities, consistent with OS command injection or other exploitation of the ColdFusion server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: ColdFusion Service Spawning Shell or Reconnaissance Command description: Detects the ColdFusion server process (coldfusion.exe) spawning command interpreters or recon/download utilities. This is consistent with OS command injection or code execution flaws in ColdFusion and its bundled components. tags: - attack.execution - attack.t1203 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \coldfusion.exe Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \whoami.exe - \net.exe - \net1.exe - \certutil.exe - \bitsadmin.exe - \curl.exe condition: selection falsepositives: - ColdFusion applications that intentionally use cfexecute to run batch files or admin scripts - Scheduled ColdFusion maintenance tasks invoking cmd.exe level: high id: a4515e76-7b9a-50e2-aa24-b8abfcea8a97 status: experimental author: Vorant references: - https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-005 ``` Behavioural rules are generated from public reporting — validate in your environment before deploying. Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-005 --- This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c52b270e-15b1-5a30-966b-6061473d7144/adobe-products-patch-arbitrary-code-execution-flaws. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup