Adobe patches dozens of RCE flaws across product suite
Adobe issued fixes for over 30 vulnerabilities in Bridge, Connect, InDesign, Premiere Pro, Substance 3D, AEM Forms and the Content Credentials SDK, some allowing arbitrary code execution.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 36 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
MS-ISAC published an advisory detailing multiple vulnerabilities across a broad set of Adobe products, including Adobe Bridge, Adobe Connect, InDesign, Premiere Pro, Substance 3D Modeler, Adobe Experience Manager (AEM) Forms, and the Content Credentials/C2PA SDK. The most severe issues — heap and stack-based buffer overflows, out-of-bounds read/write, uncontrolled recursion, and NULL pointer dereference bugs — could allow arbitrary code execution in the context of the logged-on user, giving an attacker the ability to install programs, alter or delete data, or create new accounts, with impact scaling to the privileges of the affected account. Adobe Connect additionally carries multiple SQL injection, stored/reflected XSS, path traversal, and improper certificate validation flaws, while AEM Forms includes SSRF, CSRF, and authorization issues, and the Content Credentials SDK has several input validation, resource consumption, and integer overflow bugs.
There are no reports of in-the-wild exploitation for any of these vulnerabilities at time of publication. Affected versions span current and LTS release lines for each product (e.g., Adobe Bridge 15.1.7/16.0.6 and earlier, Adobe Connect 12.11 and earlier, InDesign ID20.5.4/ID21.5 and earlier, AEM 6.5 Forms 6.5.25 and earlier, and c2patool/c2pa Rust SDK versions up to v0.26.70/v0.89.2). Defenders should prioritize patching based on exposure — internet-facing AEM Forms and Adobe Connect deployments carrying injection and SSRF flaws warrant the fastest attention, while desktop application vulnerabilities (Bridge, InDesign, Premiere Pro, Substance 3D) are most relevant where users open untrusted files or media.
Standard mitigations apply: patch to the latest stable channel releases, enforce least privilege so exploitation impact is limited for non-administrative users, enable anti-exploitation and application allowlisting controls, and monitor for anomalous process/file behavior consistent with client-side exploitation (ATT&CK T1203, Exploitation for Client Execution). Given the breadth of products and the mix of severities, organizations should treat this as a standard patch-management cycle rather than an emergency response, absent evidence of active exploitation.
Mentioned in this report
Detection guidance
Adobe Application Spawning Suspicious Child Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Adobe desktop applications (Bridge, InDesign, Premiere Pro, Substance 3D) spawning cmd.exe, powershell.exe, or other shell interpreters — indicative of post-exploitation code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Application Spawning Suspicious Child Process
description: Detects Adobe desktop applications (Bridge, InDesign, Premiere Pro, Substance
3D Modeler) spawning cmd.exe, powershell.exe, or other command shells, consistent
with RCE exploitation chain allowing arbitrary code execution in the context of
the logged-on user.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \Bridge.exe
- \InDesign.exe
- \Premiere.exe
- \Modeler.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \cscript.exe
- \wscript.exe
condition: selection_parent and selection_child
falsepositives:
- Adobe plugins or extensions that legitimately spawn shells for file operations
- User-initiated scripting within Adobe applications
level: high
id: aade4c08-6a5f-5bc2-a292-eb6aba3dd7bb
status: experimental
author: Vorant
Adobe Connect Web Application Spawning System Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Adobe Connect server process spawning cmd.exe or powershell.exe, indicative of exploitation of injection or SSRF vulnerabilities leading to code execution on the application server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Connect Web Application Spawning System Process
description: Detects Adobe Connect application process spawning cmd.exe, powershell.exe,
or other system shells, consistent with exploitation of SQL injection, SSRF, or
other server-side vulnerabilities in Adobe Connect 12.x and earlier allowing arbitrary
code execution in application context.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains: AdobeConnect
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \cscript.exe
- \wscript.exe
filter_adobe_internal:
CommandLine|contains:
- /c tasklist
- /c ipconfig
condition: selection_parent and selection_child and not filter_adobe_internal
falsepositives:
- Adobe Connect system diagnostics or health-check scripts
- Adobe Connect plugins performing legitimate system operations
level: high
id: 09ced684-b83e-5ed3-81d4-1e7fcc2f5c24
status: experimental
author: Vorant
Suspicious File Write Following Adobe Application Launch
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Adobe application process writing executable files (.exe, .dll, .scr) to user-writable directories immediately after launch, consistent with exploitation triggering payload drop. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious File Write Following Adobe Application Launch
description: Detects Adobe desktop applications writing executable files to temp or
user-writable directories, consistent with buffer overflow or deserialization exploitation
followed by payload staging and execution (T1203).
tags:
- attack.execution
- attack.t1203
logsource:
category: file_event
product: windows
detection:
selection_process:
Image|endswith:
- \Bridge.exe
- \InDesign.exe
- \Premiere.exe
- \Modeler.exe
selection_file:
TargetFilename|endswith:
- .exe
- .dll
- .scr
- .bat
TargetFilename|contains:
- \Temp\
- \AppData\Local\
- \AppData\Roaming\
filter_installer:
TargetFilename|contains:
- Adobe
- Update
condition: selection_process and selection_file and not filter_installer
falsepositives:
- Adobe auto-update or plugin installation routines
- Legitimate cache/temp file creation by Adobe features
level: medium
id: ca815e45-eb9d-5ede-ae1e-3074b3f48b6c
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-099
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs