Adobe Patches Dozens of RCE Flaws Across Product Line

Adobe released fixes for over 130 vulnerabilities in AEM, ColdFusion, Photoshop, Illustrator, Animate, Commerce, Acrobat/Reader, and Campaign Classic, several allowing arbitrary code execution.

MS-ISAC issued an advisory covering a large batch of vulnerabilities across the Adobe product portfolio, including Adobe Experience Manager, ColdFusion, Photoshop, Illustrator, Animate, Commerce/Magento, Acrobat and Acrobat Reader, and Campaign Classic. The most severe issues include eval/code injection in ColdFusion and Animate, OS command injection in Campaign Classic, SQL injection in ColdFusion, and a large number of memory-corruption bugs (heap/out-of-bounds writes, use-after-free, double-free, type confusion, integer overflows) in Acrobat Reader and Photoshop that could lead to arbitrary code execution in the context of the logged-on user. Adobe Commerce and Magento are affected by multiple authorization bypass and path traversal issues, while AEM carries a large volume of stored and DOM-based XSS findings alongside an authorization flaw.

There are no current reports of in-the-wild exploitation for any of these vulnerabilities. Given the breadth of affected products — spanning enterprise CMS/e-commerce platforms, a web application server, and widely deployed desktop creative and PDF software — organizations should prioritize patching based on internet exposure and privilege level of affected user accounts. Standard mitigations include prompt patching, least-privilege enforcement, application allowlisting, and anti-exploitation controls, as outlined in Adobe's and MS-ISAC's recommendations.

title: ColdFusion Eval/Code Injection Exploitation
description: 'Detects exploitation of ColdFusion eval/code injection vulnerabilities:
  cfusion.exe spawning cmd.exe, powershell.exe, or containing eval/execute directives
  in command line. Targets RCE achieved through injected CFML code execution.'
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_cfusion_child_shell:
    ParentImage|endswith:
    - \cfusion.exe
    - \cfusions.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  selection_cfusion_eval:
    ParentImage|endswith:
    - \cfusion.exe
    - \cfusions.exe
    CommandLine|contains:
    - eval(
    - execute(
    - cfexecute
  filter_admin_maint:
    User|contains:
    - SYSTEM
    - LOCAL SERVICE
  condition: (selection_cfusion_child_shell or selection_cfusion_eval) and not filter_admin_maint
falsepositives:
- ColdFusion developer debugging or legitimate admin scripting via CFML tags
- Enterprise scheduled reports that invoke OS commands via cfexecute (rare in prod)
level: high
id: b123db6d-9182-5fcf-acbc-ee5365ea8cf9
status: experimental
author: Vorant

title: Adobe Campaign Classic OS Command Injection
description: 'Detects exploitation of OS command injection in Adobe Campaign Classic:
  nlserver or Campaign processes spawning cmd.exe, bash, or sh with suspicious command-line
  arguments containing shell metacharacters (pipes, redirects, semicolons, backticks).'
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_campaign_parent:
    ParentImage|endswith:
    - \nlserver.exe
    - \campaign.exe
  selection_shell_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \bash.exe
    - \sh.exe
  selection_shell_args:
    CommandLine|contains:
    - '|'
    - '&'
    - ;
    - '`'
    - $(\
    - '>'
    - <
  filter_legit_workflow:
    CommandLine|contains:
    - /c echo
    - /c ipconfig
  condition: selection_campaign_parent and selection_shell_child and selection_shell_args
    and not filter_legit_workflow
falsepositives:
- Campaign Classic system tasks that legitimately invoke OS commands for reporting
  or log rotation
level: high
id: 0b6e280b-6bdb-56d8-aeec-b3e59694ed17
status: experimental
author: Vorant

title: Adobe Acrobat/Reader Memory Corruption RCE
description: 'Detects potential exploitation of memory-corruption vulnerabilities
  (heap overflow, use-after-free, type confusion, integer overflow) in Adobe Acrobat
  or Reader: spawning cmd.exe/powershell.exe from AcroRd32.exe or Acrobat.exe, or
  accessing suspicious registry/file paths consistent with post-exploitation code
  execution.'
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_adobe_parent:
    ParentImage|endswith:
    - \AcroRd32.exe
    - \Acrobat.exe
    - \AdobeApp.exe
  selection_shell_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
  filter_crash_reporter:
    Image|endswith:
    - \WerFault.exe
    - \DbgReg.exe
  condition: selection_adobe_parent and selection_shell_child and not filter_crash_reporter
falsepositives:
- PDF embedding legitimate launchers (e.g., Print to PDF workflows via cmd.exe)
- Acrobat plugins spawning utilities for embedded workflows
level: high
id: a8284087-345c-5ac6-ab82-5ca8fe2ebcb4
status: experimental
author: Vorant

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-091