# Multiple critical flaws across Adobe products allow arbitrary code execution

Published: 2026-06-09 · Severity: routine · Sectors: technology, media, manufacturing, government-national, defense, financial-services, healthcare
Canonical: https://vorant.io/reports/ec9296b5-54c3-5e1c-803c-9a0b241dfe69/multiple-critical-flaws-across-adobe-products-allow-arbitrary-code-execution

> Adobe released patches for dozens of memory-corruption and injection flaws across creative and enterprise products; no active exploitation reported yet.

Adobe disclosed a substantial batch of vulnerabilities affecting 13 products across creative, conferencing, and enterprise application suites. The most severe are memory-corruption flaws (buffer overflows, NULL pointer dereferences, out-of-bounds access) in After Effects, Substance 3D Viewer, InCopy, InDesign, Illustrator, and FrameMaker that permit arbitrary code execution in the context of the logged-on user. Adobe Connect and Experience Manager Forms each carry a deserialization flaw; ColdFusion is affected by XXE, command injection, XSS, SSRF, and access-control issues; Experience Manager Screens has reflected XSS. The advisory states no in-the-wild exploitation has been observed. Affected versions span current and recent releases—InDesign 20.3 and earlier, Illustrator 2025 29.5.1 and earlier, ColdFusion 2025 Update 2 and earlier, and others. Patched versions are available on the stable channel.

## Mentioned in this report

- Vulnerabilities: CVE-2025-27165, CVE-2025-27203, CVE-2025-30312, CVE-2025-30313, CVE-2025-43580, CVE-2025-43582, CVE-2025-43583, CVE-2025-43584, CVE-2025-43587, CVE-2025-43591, CVE-2025-43592, CVE-2025-43594, CVE-2025-47097, CVE-2025-47098, CVE-2025-47099, CVE-2025-47103, CVE-2025-47109, CVE-2025-47121, CVE-2025-47122, CVE-2025-47123, CVE-2025-47124, CVE-2025-47125, CVE-2025-47126, CVE-2025-47127, CVE-2025-47129, CVE-2025-47131, CVE-2025-47132, CVE-2025-47133, CVE-2025-47134, CVE-2025-47135, CVE-2025-47136, CVE-2025-49524, CVE-2025-49525, CVE-2025-49526, CVE-2025-49527, CVE-2025-49528, CVE-2025-49529, CVE-2025-49530, CVE-2025-49531, CVE-2025-49532

## Detection guidance (public sample)

### Adobe Creative Application Spawning Shell or Script Interpreter

ATT&CK: T1203

Illustrator, InDesign, InCopy, After Effects or FrameMaker spawning a command shell, script host or LOLBin, which is typical post-exploitation of a memory-corruption flaw triggered by a malicious file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Adobe Creative Application Spawning Shell or Script Interpreter
description: Detects Adobe creative desktop applications (Illustrator, InDesign, InCopy,
  After Effects, FrameMaker) spawning shells, script hosts or download/execute LOLBins.
  Memory-corruption flaws in these products yield code execution as the logged-on
  user, and the shellcode commonly launches a child process. Generalises on the parent/child
  relation, not on any specific file or version.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \Illustrator.exe
    - \InDesign.exe
    - \InCopy.exe
    - \AfterFX.exe
    - \FrameMaker.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \curl.exe
  condition: selection
falsepositives:
- Adobe plugins or export scripts that legitimately invoke cmd.exe for batch processing
- Studio automation or render-farm scripts launched from After Effects
level: high
id: 6276b26e-3dc7-502c-8666-7a9ea8540ec9
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-065
```

### ColdFusion Server Process Spawning Shell or Recon Utility

ATT&CK: T1190

Adobe ColdFusion process spawning a command shell or common recon/download utility, indicating command injection or deserialization exploitation of the web application server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ColdFusion Server Process Spawning Shell or Recon Utility
description: Detects a process running from a ColdFusion install path spawning cmd,
  PowerShell or common recon and download utilities. ColdFusion command injection,
  XXE-to-RCE and deserialization flaws typically result in the application server
  launching OS commands. Generalises on the parent/child relation rather than payload
  content.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: \ColdFusion
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \whoami.exe
    - \net.exe
    - \net1.exe
    - \nltest.exe
    - \curl.exe
  condition: selection
falsepositives:
- ColdFusion cfexecute tags used by applications for legitimate administrative scripts
- Scheduled ColdFusion tasks that call batch files
level: high
id: 14fd535a-1aad-5b1a-8a9c-b97a1a48fc65
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-065
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-065

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ec9296b5-54c3-5e1c-803c-9a0b241dfe69/multiple-critical-flaws-across-adobe-products-allow-arbitrary-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup