# Adobe Patches Dozens of RCE Flaws Across Product Line

Published: 2026-09-08 · Severity: high
Canonical: https://vorant.io/reports/d20655c1-5dd6-534d-9f7c-8f033ab32994/adobe-patches-dozens-of-rce-flaws-across-product-line

> Adobe released fixes for over 130 vulnerabilities in AEM, ColdFusion, Photoshop, Illustrator, Animate, Commerce, Acrobat/Reader, and Campaign Classic, several allowing arbitrary code execution.

MS-ISAC issued an advisory covering a large batch of vulnerabilities across the Adobe product portfolio, including Adobe Experience Manager, ColdFusion, Photoshop, Illustrator, Animate, Commerce/Magento, Acrobat and Acrobat Reader, and Campaign Classic. The most severe issues include eval/code injection in ColdFusion and Animate, OS command injection in Campaign Classic, SQL injection in ColdFusion, and a large number of memory-corruption bugs (heap/out-of-bounds writes, use-after-free, double-free, type confusion, integer overflows) in Acrobat Reader and Photoshop that could lead to arbitrary code execution in the context of the logged-on user. Adobe Commerce and Magento are affected by multiple authorization bypass and path traversal issues, while AEM carries a large volume of stored and DOM-based XSS findings alongside an authorization flaw.

There are no current reports of in-the-wild exploitation for any of these vulnerabilities. Given the breadth of affected products — spanning enterprise CMS/e-commerce platforms, a web application server, and widely deployed desktop creative and PDF software — organizations should prioritize patching based on internet exposure and privilege level of affected user accounts. Standard mitigations include prompt patching, least-privilege enforcement, application allowlisting, and anti-exploitation controls, as outlined in Adobe's and MS-ISAC's recommendations.

## Mentioned in this report

- Vulnerabilities: CVE-2026-19232, CVE-2026-21269, CVE-2026-48273, CVE-2026-75631, CVE-2026-75650 (KEV), CVE-2026-75726, CVE-2026-75746, CVE-2026-75771, CVE-2026-75862, CVE-2026-75863, CVE-2026-75990, CVE-2026-75991, CVE-2026-75992, CVE-2026-75998, CVE-2026-75999, CVE-2026-76000, CVE-2026-76190, CVE-2026-76191, CVE-2026-76199, CVE-2026-76200, CVE-2026-76201, CVE-2026-76202, CVE-2026-77108, CVE-2026-77109, CVE-2026-77110, CVE-2026-77111, CVE-2026-77774, CVE-2026-79907, CVE-2026-79909, CVE-2026-80161, CVE-2026-81983, CVE-2026-81987, CVE-2026-81992, CVE-2026-81994, CVE-2026-81996, CVE-2026-82001, CVE-2026-82004, CVE-2026-82005, CVE-2026-82006, CVE-2026-82007

## Detection guidance (public sample)

### ColdFusion Eval/Code Injection Exploitation

ATT&CK: T1203

Detects ColdFusion process executing with cfexecute or eval-like patterns in command line or spawning cmd.exe/powershell.exe unexpectedly from cfusion.exe parent. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ColdFusion Eval/Code Injection Exploitation
description: 'Detects exploitation of ColdFusion eval/code injection vulnerabilities:
  cfusion.exe spawning cmd.exe, powershell.exe, or containing eval/execute directives
  in command line. Targets RCE achieved through injected CFML code execution.'
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_cfusion_child_shell:
    ParentImage|endswith:
    - \cfusion.exe
    - \cfusions.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  selection_cfusion_eval:
    ParentImage|endswith:
    - \cfusion.exe
    - \cfusions.exe
    CommandLine|contains:
    - eval(
    - execute(
    - cfexecute
  filter_admin_maint:
    User|contains:
    - SYSTEM
    - LOCAL SERVICE
  condition: (selection_cfusion_child_shell or selection_cfusion_eval) and not filter_admin_maint
falsepositives:
- ColdFusion developer debugging or legitimate admin scripting via CFML tags
- Enterprise scheduled reports that invoke OS commands via cfexecute (rare in prod)
level: high
id: b123db6d-9182-5fcf-acbc-ee5365ea8cf9
status: experimental
author: Vorant
```

### Adobe Campaign Classic OS Command Injection

ATT&CK: T1203

Detects Campaign Classic process spawning shell or command-line interpreter with shell metacharacters or system command patterns in arguments. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Adobe Campaign Classic OS Command Injection
description: 'Detects exploitation of OS command injection in Adobe Campaign Classic:
  nlserver or Campaign processes spawning cmd.exe, bash, or sh with suspicious command-line
  arguments containing shell metacharacters (pipes, redirects, semicolons, backticks).'
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_campaign_parent:
    ParentImage|endswith:
    - \nlserver.exe
    - \campaign.exe
  selection_shell_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \bash.exe
    - \sh.exe
  selection_shell_args:
    CommandLine|contains:
    - '|'
    - '&'
    - ;
    - '`'
    - $(\
    - '>'
    - <
  filter_legit_workflow:
    CommandLine|contains:
    - /c echo
    - /c ipconfig
  condition: selection_campaign_parent and selection_shell_child and selection_shell_args
    and not filter_legit_workflow
falsepositives:
- Campaign Classic system tasks that legitimately invoke OS commands for reporting
  or log rotation
level: high
id: 0b6e280b-6bdb-56d8-aeec-b3e59694ed17
status: experimental
author: Vorant
```

### Adobe Acrobat/Reader Memory Corruption RCE via Exploit Code

ATT&CK: T1203

Detects Acrobat/Reader process crashing or spawning child processes indicative of exploited memory corruption bugs (crash handlers, exception code paths). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Adobe Acrobat/Reader Memory Corruption RCE
description: 'Detects potential exploitation of memory-corruption vulnerabilities
  (heap overflow, use-after-free, type confusion, integer overflow) in Adobe Acrobat
  or Reader: spawning cmd.exe/powershell.exe from AcroRd32.exe or Acrobat.exe, or
  accessing suspicious registry/file paths consistent with post-exploitation code
  execution.'
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_adobe_parent:
    ParentImage|endswith:
    - \AcroRd32.exe
    - \Acrobat.exe
    - \AdobeApp.exe
  selection_shell_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
  filter_crash_reporter:
    Image|endswith:
    - \WerFault.exe
    - \DbgReg.exe
  condition: selection_adobe_parent and selection_shell_child and not filter_crash_reporter
falsepositives:
- PDF embedding legitimate launchers (e.g., Print to PDF workflows via cmd.exe)
- Acrobat plugins spawning utilities for embedded workflows
level: high
id: a8284087-345c-5ac6-ab82-5ca8fe2ebcb4
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-091

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d20655c1-5dd6-534d-9f7c-8f033ab32994/adobe-patches-dozens-of-rce-flaws-across-product-line.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup