# Adobe patches 100+ flaws across Creative Cloud suite

Published: 2026-06-09 · Severity: high · Sectors: technology, media
Canonical: https://vorant.io/reports/d9e4abec-8ad6-4755-bbb8-2dd92634538a/adobe-patches-100-flaws-across-creative-cloud-suite

> Adobe released patches for over 100 vulnerabilities across 14 products including Commerce, Photoshop, Illustrator, and InDesign, with the most severe enabling arbitrary code execution.

Adobe has released security updates addressing more than 100 vulnerabilities across 14 products in its software portfolio. The affected applications span Adobe Commerce/Magento, Creative Cloud tools (Photoshop, Illustrator, InDesign, InCopy, Animate), and the Substance 3D suite (Viewer, Modeler, Painter, Sampler, Stager), as well as FrameMaker and Dimension. The most severe vulnerabilities could allow attackers to achieve arbitrary code execution in the context of the logged-on user.

The vulnerability types include out-of-bounds write and read conditions, use-after-free flaws, heap-based and stack-based buffer overflows, NULL pointer dereferences, and privilege escalation issues. Adobe Commerce is affected by application denial-of-service, privilege escalation, arbitrary file system read, and security feature bypass vulnerabilities. The MS-ISAC has classified these as requiring immediate patching but notes there are currently no reports of active exploitation in the wild.

Organizations should prioritize patching based on which Adobe products are deployed in their environments. The vulnerabilities require user interaction to exploit, typically through opening malicious files in the affected applications. Successful exploitation depends on the privileges of the logged-on user, with administrative accounts presenting higher risk than restricted user accounts.

## Mentioned in this report

- Vulnerabilities: CVE-2025-49554, CVE-2025-49555, CVE-2025-49556, CVE-2025-49557, CVE-2025-49558, CVE-2025-49559, CVE-2025-49560, CVE-2025-49561, CVE-2025-49562, CVE-2025-49563, CVE-2025-49564, CVE-2025-49567, CVE-2025-49568, CVE-2025-49569, CVE-2025-49570, CVE-2025-49571, CVE-2025-49572, CVE-2025-49573, CVE-2025-54186, CVE-2025-54187, CVE-2025-54188, CVE-2025-54189, CVE-2025-54190, CVE-2025-54191, CVE-2025-54192, CVE-2025-54193, CVE-2025-54194, CVE-2025-54195, CVE-2025-54197, CVE-2025-54198, CVE-2025-54199, CVE-2025-54200, CVE-2025-54201, CVE-2025-54202, CVE-2025-54203, CVE-2025-54204, CVE-2025-54205, CVE-2025-54206, CVE-2025-54207, CVE-2025-54235

## Detection guidance (public sample)

### Suspicious Child Process Spawned from Adobe Creative Cloud/Reader Applications

ATT&CK: T1203

Detects command/script interpreters or LOLBins spawned as children of Adobe Creative Cloud, Substance 3D, or Acrobat processes, consistent with exploitation of a client-side vulnerability after opening a malicious file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned from Adobe Creative Cloud/Reader Applications
id: e8d771d8-804e-5f77-bbb7-44b51ba0aaef
status: experimental
description: Detects command/script interpreters or LOLBins spawned as children of
  Adobe Creative Cloud, Substance 3D, or Acrobat processes, consistent with exploitation
  of a client-side vulnerability after opening a malicious file.
references:
- https://helpx.adobe.com/security.html
author: Vorant
tags:
- attack.t1203
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  parent_selection:
    ParentImage|endswith:
    - \Photoshop.exe
    - \Illustrator.exe
    - \InDesign.exe
    - \InCopy.exe
    - \Animate.exe
    - \FrameMaker.exe
    - \Dimension.exe
    - \Acrobat.exe
    - \AcroRd32.exe
    - \Substance3DPainter.exe
    - \Substance3DSampler.exe
    - \Substance3DStager.exe
    - \Substance3DViewer.exe
    - \Substance3DModeler.exe
  child_selection:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  filter_updater:
    CommandLine|contains:
    - AdobeARM
    - AdobeUpdater
    - CCXProcess
    - \Adobe\OOBE\
  condition: parent_selection and child_selection and not filter_updater
falsepositives:
- Adobe auto-update helper processes launching legitimate update scripts
- Enterprise software deployment tools invoking scripting engines from Adobe install
  directories
level: high
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-071

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d9e4abec-8ad6-4755-bbb8-2dd92634538a/adobe-patches-100-flaws-across-creative-cloud-suite.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup