Adobe Patches Dozens of RCE Flaws Across Product Line

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Adobe released fixes for over 130 vulnerabilities in AEM, ColdFusion, Photoshop, Illustrator, Animate, Commerce, Acrobat/Reader, and Campaign Classic, several allowing arbitrary code execution.

Sourcecisecurity.org — open the original

MS-ISAC issued an advisory covering a large batch of vulnerabilities across the Adobe product portfolio, including Adobe Experience Manager, ColdFusion, Photoshop, Illustrator, Animate, Commerce/Magento, Acrobat and Acrobat Reader, and Campaign Classic. The most severe issues include eval/code injection in ColdFusion and Animate, OS command injection in Campaign Classic, SQL injection in ColdFusion, and a large number of memory-corruption bugs (heap/out-of-bounds writes, use-after-free, double-free, type confusion, integer overflows) in Acrobat Reader and Photoshop that could lead to arbitrary code execution in the context of the logged-on user. Adobe Commerce and Magento are affected by multiple authorization bypass and path traversal issues, while AEM carries a large volume of stored and DOM-based XSS findings alongside an authorization flaw.

There are no current reports of in-the-wild exploitation for any of these vulnerabilities. Given the breadth of affected products — spanning enterprise CMS/e-commerce platforms, a web application server, and widely deployed desktop creative and PDF software — organizations should prioritize patching based on internet exposure and privilege level of affected user accounts. Standard mitigations include prompt patching, least-privilege enforcement, application allowlisting, and anti-exploitation controls, as outlined in Adobe's and MS-ISAC's recommendations.

title: ColdFusion Eval/Code Injection Exploitation
description: 'Detects exploitation of ColdFusion eval/code injection vulnerabilities:
  cfusion.exe spawning cmd.exe, powershell.exe, or containing eval/execute directives
  in command line. Targets RCE achieved through injected CFML code execution.'
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_cfusion_child_shell:
    ParentImage|endswith:
    - \cfusion.exe
    - \cfusions.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  selection_cfusion_eval:
    ParentImage|endswith:
    - \cfusion.exe
    - \cfusions.exe
    CommandLine|contains:
    - eval(
    - execute(
    - cfexecute
  filter_admin_maint:
    User|contains:
    - SYSTEM
    - LOCAL SERVICE
  condition: (selection_cfusion_child_shell or selection_cfusion_eval) and not filter_admin_maint
falsepositives:
- ColdFusion developer debugging or legitimate admin scripting via CFML tags
- Enterprise scheduled reports that invoke OS commands via cfexecute (rare in prod)
level: high
id: b123db6d-9182-5fcf-acbc-ee5365ea8cf9
status: experimental
author: Vorant

title: Adobe Campaign Classic OS Command Injection
description: 'Detects exploitation of OS command injection in Adobe Campaign Classic:
  nlserver or Campaign processes spawning cmd.exe, bash, or sh with suspicious command-line
  arguments containing shell metacharacters (pipes, redirects, semicolons, backticks).'
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_campaign_parent:
    ParentImage|endswith:
    - \nlserver.exe
    - \campaign.exe
  selection_shell_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \bash.exe
    - \sh.exe
  selection_shell_args:
    CommandLine|contains:
    - '|'
    - '&'
    - ;
    - '`'
    - $(\
    - '>'
    - <
  filter_legit_workflow:
    CommandLine|contains:
    - /c echo
    - /c ipconfig
  condition: selection_campaign_parent and selection_shell_child and selection_shell_args
    and not filter_legit_workflow
falsepositives:
- Campaign Classic system tasks that legitimately invoke OS commands for reporting
  or log rotation
level: high
id: 0b6e280b-6bdb-56d8-aeec-b3e59694ed17
status: experimental
author: Vorant

title: Adobe Acrobat/Reader Memory Corruption RCE
description: 'Detects potential exploitation of memory-corruption vulnerabilities
  (heap overflow, use-after-free, type confusion, integer overflow) in Adobe Acrobat
  or Reader: spawning cmd.exe/powershell.exe from AcroRd32.exe or Acrobat.exe, or
  accessing suspicious registry/file paths consistent with post-exploitation code
  execution.'
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_adobe_parent:
    ParentImage|endswith:
    - \AcroRd32.exe
    - \Acrobat.exe
    - \AdobeApp.exe
  selection_shell_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
  filter_crash_reporter:
    Image|endswith:
    - \WerFault.exe
    - \DbgReg.exe
  condition: selection_adobe_parent and selection_shell_child and not filter_crash_reporter
falsepositives:
- PDF embedding legitimate launchers (e.g., Print to PDF workflows via cmd.exe)
- Acrobat plugins spawning utilities for embedded workflows
level: high
id: a8284087-345c-5ac6-ab82-5ca8fe2ebcb4
status: experimental
author: Vorant

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-091

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.