# Multiple Adobe product vulnerabilities enable arbitrary code execution

Published: 2026-06-09 · Severity: elevated · Sectors: technology, financial-services, manufacturing
Canonical: https://vorant.io/reports/c9db7562-219a-5e11-b755-ac62f0973d19/multiple-adobe-product-vulnerabilities-enable-arbitrary-code-execution

> Multiple critical vulnerabilities across Adobe Commerce, ColdFusion, and Creative Cloud products allow arbitrary code execution; no active exploitation reported.

Adobe has disclosed multiple vulnerabilities affecting a broad range of products, with the most severe allowing arbitrary code execution in the context of the logged-on user. Affected products span both enterprise solutions (Adobe Commerce, ColdFusion, Experience Manager Forms and Screens) and creative applications (After Effects, Photoshop, Premiere Pro, Animate, Bridge, Media Encoder, FrameMaker). The vulnerabilities include authorization bypasses, deserialization flaws, buffer overflows, path traversal, and command injection issues. ColdFusion is particularly affected with 16 CVEs, including multiple deserialization and access control flaws. Adobe Commerce and Magento Open Source have authorization and CSRF vulnerabilities affecting multiple versions back to 2.4.4. Creative applications suffer primarily from memory corruption vulnerabilities (buffer overflows, out-of-bounds access) that could lead to code execution. According to the advisory, there are currently no reports of these vulnerabilities being exploited in the wild, but the breadth and severity of the flaws warrant prompt patching. Impact depends on user privileges; administrators face greater risk than restricted users.

## Mentioned in this report

- Vulnerabilities: CVE-2024-38819 (templated), CVE-2024-38820, CVE-2025-24446, CVE-2025-24447, CVE-2025-27182, CVE-2025-27183, CVE-2025-27184, CVE-2025-27185, CVE-2025-27186, CVE-2025-27187, CVE-2025-27188, CVE-2025-27189, CVE-2025-27190, CVE-2025-27191, CVE-2025-27192, CVE-2025-27193, CVE-2025-27194, CVE-2025-27195, CVE-2025-27196, CVE-2025-27198, CVE-2025-27199, CVE-2025-27200, CVE-2025-27201, CVE-2025-27202, CVE-2025-27204, CVE-2025-27205, CVE-2025-30281, CVE-2025-30282, CVE-2025-30283, CVE-2025-30284, CVE-2025-30285, CVE-2025-30286, CVE-2025-30287, CVE-2025-30288, CVE-2025-30289, CVE-2025-30290, CVE-2025-30291, CVE-2025-30292, CVE-2025-30293, CVE-2025-30294

## Detection guidance (public sample)

### ColdFusion Server Process Spawning Shell or LOLBin

ATT&CK: T1190

Adobe ColdFusion service process spawning a command interpreter or download/exec utility, consistent with exploitation of deserialization or command injection flaws. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ColdFusion Server Process Spawning Shell or LOLBin
id: 0f2ed767-1e52-570d-a3ac-e0e99c42f135
status: experimental
description: Detects the Adobe ColdFusion service process (coldfusion.exe) spawning
  a command interpreter or common download/execution utility. This is a typical post-exploitation
  pattern after exploiting ColdFusion deserialization, access control or command injection
  vulnerabilities. Generalises on the parent/child relation, not on specific payloads.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \coldfusion.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \whoami.exe
    - \net.exe
    - \net1.exe
  condition: selection
falsepositives:
- ColdFusion applications that deliberately shell out via cfexecute for administrative
  scripts
- ColdFusion installer or updater helper scripts launched by the service
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-039
```

### Adobe Creative Application Spawning Script Interpreter or LOLBin

ATT&CK: T1203

Adobe creative applications (Photoshop, Premiere Pro, After Effects, Animate, Bridge, Media Encoder, FrameMaker) spawning shells or script/LOLBin processes, indicating possible memory-corruption exploitation via a malicious file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Adobe Creative Application Spawning Script Interpreter or LOLBin
id: 821edac5-1729-5e8d-a584-035a5250a115
status: experimental
description: Detects Adobe creative applications spawning command interpreters or
  living-off-the-land binaries. Memory corruption flaws (buffer overflow, out-of-bounds)
  in these products can give code execution in the context of the logged-on user after
  a malicious document or media file is opened.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \Photoshop.exe
    - \Adobe Premiere Pro.exe
    - \AfterFX.exe
    - \Animate.exe
    - \Bridge.exe
    - \Adobe Media Encoder.exe
    - \FrameMaker.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Adobe plug-ins or user scripts (JSX/automation) that legitimately invoke cmd.exe
  or PowerShell
- Render or pipeline automation in media production environments
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-039
```

### PHP-FPM Worker Spawning Shell With Download or Reverse Shell Pattern

ATT&CK: T1190

PHP web worker (as used by Adobe Commerce/Magento) spawning a shell with download, decode or reverse-shell command-line patterns, suggesting web exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PHP-FPM Worker Spawning Shell With Download or Reverse Shell Pattern
id: 64d3e59e-1976-57be-9e03-31d61329d57c
status: experimental
description: Detects a php-fpm worker (hosting Adobe Commerce / Magento Open Source)
  spawning a shell whose command line contains download, decode or reverse-shell patterns.
  Indicates possible exploitation of authorization bypass or command injection flaws
  in the public-facing storefront.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains: php-fpm
    Image|endswith:
    - /sh
    - /bash
    - /dash
    CommandLine|contains:
    - curl
    - wget
    - base64 -d
    - /dev/tcp/
    - nc -e
    - mkfifo
  condition: selection
falsepositives:
- Magento extensions that shell out to curl or wget for legitimate integrations
- Deployment or cache-warming scripts triggered through PHP
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-039
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-039

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c9db7562-219a-5e11-b755-ac62f0973d19/multiple-adobe-product-vulnerabilities-enable-arbitrary-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup