Multiple Adobe product vulnerabilities enable arbitrary code execution

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Multiple critical vulnerabilities across Adobe Commerce, ColdFusion, and Creative Cloud products allow arbitrary code execution; no active exploitation reported.

Adobe has disclosed multiple vulnerabilities affecting a broad range of products, with the most severe allowing arbitrary code execution in the context of the logged-on user. Affected products span both enterprise solutions (Adobe Commerce, ColdFusion, Experience Manager Forms and Screens) and creative applications (After Effects, Photoshop, Premiere Pro, Animate, Bridge, Media Encoder, FrameMaker). The vulnerabilities include authorization bypasses, deserialization flaws, buffer overflows, path traversal, and command injection issues. ColdFusion is particularly affected with 16 CVEs, including multiple deserialization and access control flaws. Adobe Commerce and Magento Open Source have authorization and CSRF vulnerabilities affecting multiple versions back to 2.4.4. Creative applications suffer primarily from memory corruption vulnerabilities (buffer overflows, out-of-bounds access) that could lead to code execution. According to the advisory, there are currently no reports of these vulnerabilities being exploited in the wild, but the breadth and severity of the flaws warrant prompt patching. Impact depends on user privileges; administrators face greater risk than restricted users.

title: ColdFusion Server Process Spawning Shell or LOLBin
id: 0f2ed767-1e52-570d-a3ac-e0e99c42f135
status: experimental
description: Detects the Adobe ColdFusion service process (coldfusion.exe) spawning
  a command interpreter or common download/execution utility. This is a typical post-exploitation
  pattern after exploiting ColdFusion deserialization, access control or command injection
  vulnerabilities. Generalises on the parent/child relation, not on specific payloads.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \coldfusion.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \whoami.exe
    - \net.exe
    - \net1.exe
  condition: selection
falsepositives:
- ColdFusion applications that deliberately shell out via cfexecute for administrative
  scripts
- ColdFusion installer or updater helper scripts launched by the service
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-039

title: Adobe Creative Application Spawning Script Interpreter or LOLBin
id: 821edac5-1729-5e8d-a584-035a5250a115
status: experimental
description: Detects Adobe creative applications spawning command interpreters or
  living-off-the-land binaries. Memory corruption flaws (buffer overflow, out-of-bounds)
  in these products can give code execution in the context of the logged-on user after
  a malicious document or media file is opened.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \Photoshop.exe
    - \Adobe Premiere Pro.exe
    - \AfterFX.exe
    - \Animate.exe
    - \Bridge.exe
    - \Adobe Media Encoder.exe
    - \FrameMaker.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Adobe plug-ins or user scripts (JSX/automation) that legitimately invoke cmd.exe
  or PowerShell
- Render or pipeline automation in media production environments
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-039

title: PHP-FPM Worker Spawning Shell With Download or Reverse Shell Pattern
id: 64d3e59e-1976-57be-9e03-31d61329d57c
status: experimental
description: Detects a php-fpm worker (hosting Adobe Commerce / Magento Open Source)
  spawning a shell whose command line contains download, decode or reverse-shell patterns.
  Indicates possible exploitation of authorization bypass or command injection flaws
  in the public-facing storefront.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains: php-fpm
    Image|endswith:
    - /sh
    - /bash
    - /dash
    CommandLine|contains:
    - curl
    - wget
    - base64 -d
    - /dev/tcp/
    - nc -e
    - mkfifo
  condition: selection
falsepositives:
- Magento extensions that shell out to curl or wget for legitimate integrations
- Deployment or cache-warming scripts triggered through PHP
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-039

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-039