# Adobe patches dozens of RCE flaws across product suite

Published: 2026-09-23 · Severity: routine
Canonical: https://vorant.io/reports/d9152e05-a4fa-5429-80ed-1e9ff189e5cd/adobe-patches-dozens-of-rce-flaws-across-product-suite

> Adobe issued fixes for over 30 vulnerabilities in Bridge, Connect, InDesign, Premiere Pro, Substance 3D, AEM Forms and the Content Credentials SDK, some allowing arbitrary code execution.

MS-ISAC published an advisory detailing multiple vulnerabilities across a broad set of Adobe products, including Adobe Bridge, Adobe Connect, InDesign, Premiere Pro, Substance 3D Modeler, Adobe Experience Manager (AEM) Forms, and the Content Credentials/C2PA SDK. The most severe issues — heap and stack-based buffer overflows, out-of-bounds read/write, uncontrolled recursion, and NULL pointer dereference bugs — could allow arbitrary code execution in the context of the logged-on user, giving an attacker the ability to install programs, alter or delete data, or create new accounts, with impact scaling to the privileges of the affected account. Adobe Connect additionally carries multiple SQL injection, stored/reflected XSS, path traversal, and improper certificate validation flaws, while AEM Forms includes SSRF, CSRF, and authorization issues, and the Content Credentials SDK has several input validation, resource consumption, and integer overflow bugs.

There are no reports of in-the-wild exploitation for any of these vulnerabilities at time of publication. Affected versions span current and LTS release lines for each product (e.g., Adobe Bridge 15.1.7/16.0.6 and earlier, Adobe Connect 12.11 and earlier, InDesign ID20.5.4/ID21.5 and earlier, AEM 6.5 Forms 6.5.25 and earlier, and c2patool/c2pa Rust SDK versions up to v0.26.70/v0.89.2). Defenders should prioritize patching based on exposure — internet-facing AEM Forms and Adobe Connect deployments carrying injection and SSRF flaws warrant the fastest attention, while desktop application vulnerabilities (Bridge, InDesign, Premiere Pro, Substance 3D) are most relevant where users open untrusted files or media.

Standard mitigations apply: patch to the latest stable channel releases, enforce least privilege so exploitation impact is limited for non-administrative users, enable anti-exploitation and application allowlisting controls, and monitor for anomalous process/file behavior consistent with client-side exploitation (ATT&CK T1203, Exploitation for Client Execution). Given the breadth of products and the mix of severities, organizations should treat this as a standard patch-management cycle rather than an emergency response, absent evidence of active exploitation.

## Mentioned in this report

- Vulnerabilities: CVE-2026-19480, CVE-2026-34689, CVE-2026-48361, CVE-2026-75632, CVE-2026-75633, CVE-2026-75634, CVE-2026-75638, CVE-2026-75649, CVE-2026-75655, CVE-2026-75656, CVE-2026-75658, CVE-2026-75663, CVE-2026-75665, CVE-2026-75676, CVE-2026-75682, CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697, CVE-2026-75698, CVE-2026-75743, CVE-2026-75744, CVE-2026-75745, CVE-2026-76192, CVE-2026-76194, CVE-2026-79906, CVE-2026-81995, CVE-2026-81998, CVE-2026-81999, CVE-2026-82000, CVE-2026-83962, CVE-2026-83963, CVE-2026-83964, CVE-2026-84395, CVE-2026-84396, CVE-2026-89277

## Detection guidance (public sample)

### Adobe Application Spawning Suspicious Child Process

ATT&CK: T1203

Adobe desktop applications (Bridge, InDesign, Premiere Pro, Substance 3D) spawning cmd.exe, powershell.exe, or other shell interpreters — indicative of post-exploitation code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Adobe Application Spawning Suspicious Child Process
description: Detects Adobe desktop applications (Bridge, InDesign, Premiere Pro, Substance
  3D Modeler) spawning cmd.exe, powershell.exe, or other command shells, consistent
  with RCE exploitation chain allowing arbitrary code execution in the context of
  the logged-on user.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \Bridge.exe
    - \InDesign.exe
    - \Premiere.exe
    - \Modeler.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
  condition: selection_parent and selection_child
falsepositives:
- Adobe plugins or extensions that legitimately spawn shells for file operations
- User-initiated scripting within Adobe applications
level: high
id: aade4c08-6a5f-5bc2-a292-eb6aba3dd7bb
status: experimental
author: Vorant
```

### Adobe Connect Web Application Spawning System Process

ATT&CK: T1203

Adobe Connect server process spawning cmd.exe or powershell.exe, indicative of exploitation of injection or SSRF vulnerabilities leading to code execution on the application server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Adobe Connect Web Application Spawning System Process
description: Detects Adobe Connect application process spawning cmd.exe, powershell.exe,
  or other system shells, consistent with exploitation of SQL injection, SSRF, or
  other server-side vulnerabilities in Adobe Connect 12.x and earlier allowing arbitrary
  code execution in application context.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: AdobeConnect
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
  filter_adobe_internal:
    CommandLine|contains:
    - /c tasklist
    - /c ipconfig
  condition: selection_parent and selection_child and not filter_adobe_internal
falsepositives:
- Adobe Connect system diagnostics or health-check scripts
- Adobe Connect plugins performing legitimate system operations
level: high
id: 09ced684-b83e-5ed3-81d4-1e7fcc2f5c24
status: experimental
author: Vorant
```

### Suspicious File Write Following Adobe Application Launch

ATT&CK: T1203

Adobe application process writing executable files (.exe, .dll, .scr) to user-writable directories immediately after launch, consistent with exploitation triggering payload drop. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious File Write Following Adobe Application Launch
description: Detects Adobe desktop applications writing executable files to temp or
  user-writable directories, consistent with buffer overflow or deserialization exploitation
  followed by payload staging and execution (T1203).
tags:
- attack.execution
- attack.t1203
logsource:
  category: file_event
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \Bridge.exe
    - \InDesign.exe
    - \Premiere.exe
    - \Modeler.exe
  selection_file:
    TargetFilename|endswith:
    - .exe
    - .dll
    - .scr
    - .bat
    TargetFilename|contains:
    - \Temp\
    - \AppData\Local\
    - \AppData\Roaming\
  filter_installer:
    TargetFilename|contains:
    - Adobe
    - Update
  condition: selection_process and selection_file and not filter_installer
falsepositives:
- Adobe auto-update or plugin installation routines
- Legitimate cache/temp file creation by Adobe features
level: medium
id: ca815e45-eb9d-5ede-ae1e-3074b3f48b6c
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-099

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d9152e05-a4fa-5429-80ed-1e9ff189e5cd/adobe-patches-dozens-of-rce-flaws-across-product-suite.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup