Multiple critical flaws across Adobe products allow arbitrary code execution
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Adobe released patches for dozens of memory-corruption and injection flaws across creative and enterprise products; no active exploitation reported yet.
Adobe disclosed a substantial batch of vulnerabilities affecting 13 products across creative, conferencing, and enterprise application suites. The most severe are memory-corruption flaws (buffer overflows, NULL pointer dereferences, out-of-bounds access) in After Effects, Substance 3D Viewer, InCopy, InDesign, Illustrator, and FrameMaker that permit arbitrary code execution in the context of the logged-on user. Adobe Connect and Experience Manager Forms each carry a deserialization flaw; ColdFusion is affected by XXE, command injection, XSS, SSRF, and access-control issues; Experience Manager Screens has reflected XSS. The advisory states no in-the-wild exploitation has been observed. Affected versions span current and recent releases—InDesign 20.3 and earlier, Illustrator 2025 29.5.1 and earlier, ColdFusion 2025 Update 2 and earlier, and others. Patched versions are available on the stable channel.
Mentioned in this report
Detection guidance
Adobe Creative Application Spawning Shell or Script Interpreter
Illustrator, InDesign, InCopy, After Effects or FrameMaker spawning a command shell, script host or LOLBin, which is typical post-exploitation of a memory-corruption flaw triggered by a malicious file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Creative Application Spawning Shell or Script Interpreter
description: Detects Adobe creative desktop applications (Illustrator, InDesign, InCopy,
After Effects, FrameMaker) spawning shells, script hosts or download/execute LOLBins.
Memory-corruption flaws in these products yield code execution as the logged-on
user, and the shellcode commonly launches a child process. Generalises on the parent/child
relation, not on any specific file or version.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \Illustrator.exe
- \InDesign.exe
- \InCopy.exe
- \AfterFX.exe
- \FrameMaker.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \curl.exe
condition: selection
falsepositives:
- Adobe plugins or export scripts that legitimately invoke cmd.exe for batch processing
- Studio automation or render-farm scripts launched from After Effects
level: high
id: 6276b26e-3dc7-502c-8666-7a9ea8540ec9
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-065
ColdFusion Server Process Spawning Shell or Recon Utility
Adobe ColdFusion process spawning a command shell or common recon/download utility, indicating command injection or deserialization exploitation of the web application server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ColdFusion Server Process Spawning Shell or Recon Utility
description: Detects a process running from a ColdFusion install path spawning cmd,
PowerShell or common recon and download utilities. ColdFusion command injection,
XXE-to-RCE and deserialization flaws typically result in the application server
launching OS commands. Generalises on the parent/child relation rather than payload
content.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains: \ColdFusion
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \certutil.exe
- \bitsadmin.exe
- \whoami.exe
- \net.exe
- \net1.exe
- \nltest.exe
- \curl.exe
condition: selection
falsepositives:
- ColdFusion cfexecute tags used by applications for legitimate administrative scripts
- Scheduled ColdFusion tasks that call batch files
level: high
id: 14fd535a-1aad-5b1a-8a9c-b97a1a48fc65
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-065
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-065
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,571 reports from 145 sources, 595 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs