Full Report
Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution.Adobe Experience Manager (AEM) is an enterprise-grade digital experience platform that combines content management, digital asset management, and digital enrollment into a single cloud-native solution.Adobe ColdFusion is a commercial rapid web application development platform used to build, deploy, and scale dynamic enterprise web and mobile applications.Adobe Photoshop is a professional raster graphics editor used to create, edit, and manipulate digital images.Adobe Illustrator is an industry-standard vector graphics editor and design software used to create infinitely scalable artwork, logos, icons, typography, and complex illustrations.Adobe Animate is computer animation and multimedia authoring software.Adobe Commerce is a flexible, enterprise-level e-commerce platform built on top of Magento technology that helps businesses create and manage online stores.Adobe Acrobat Reader is a free software application used to view, print, sign, share, and annotate PDF (Portable Document Format) files.Adobe Campaign Classic is an enterprise marketing automation and cross-channel campaign management platform used to design, execute, and orchestrate customer journeys across online and offline channels.Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
Analysis Summary
# Vulnerability: Multiple Adobe Products Arbitrary Code Execution
## CVE Details
- **CVE ID:** CVE-2026-19232, CVE-2025-64830, CVE-2026-75735, CVE-2026-81996, CVE-2026-81997, CVE-2026-82001, CVE-2026-82004, CVE-2026-82005, CVE-2026-82006, CVE-2026-82007 (Partial list of dozens identified).
- **CVSS Score:** Not explicitly listed, but rated as **CRITICAL** (High Risk for Large/Medium entities).
- **CWE:** CWE-79 (Cross-site Scripting), CWE-285 (Incorrect Authorization), CWE-94 (Arbitrary Code Execution).
## Affected Systems
- **Products:**
- Adobe Experience Manager (AEM)
- Adobe ColdFusion
- Adobe Photoshop
- Adobe Illustrator
- Adobe Animate
- Adobe Commerce / Magento Open Source
- Adobe Acrobat / Acrobat Reader
- Adobe Campaign Classic (ACC)
- **Versions:**
- **AEM:** Cloud Service Release 2026.7.0 and earlier; 6.5 LTS SP2 and earlier.
- **ColdFusion:** 2025 (2025.0.12 and earlier); 2023 (2023.0.23 and earlier).
- **Photoshop:** 2026 (27.6 and earlier); 2025 (26.11.6 and earlier).
- **Illustrator:** 2025 (29.8.10 and earlier); 2026 (30.7 and earlier).
- **Commerce:** 2.4.4 through 2.4.9 (2026-aug versions and earlier).
- **Acrobat/Reader:** 26.002.21900 and earlier; 2024.001.30383 and earlier.
- **Configurations:** Systems running with administrative privileges are at highest risk.
## Vulnerability Description
Multiple flaws exist across Adobe's suite, primarily revolving around **Exploitation for Client Execution (T1203)**. The most severe vulnerabilities allow for **Arbitrary Code Execution (ACE)**. These include:
- **AEM:** Extensive Stored Cross-Site Scripting (XSS) and Incorrect Authorization flaws.
- **Creative Cloud/Acrobat:** Memory corruption or input validation flaws that trigger when processing maliciously crafted files.
- **Commerce/ColdFusion:** Flaws in web application logic allowing remote command execution.
## Exploitation
- **Status:** Not exploited in the wild (as of September 8, 2026).
- **Complexity:** Medium to High (requires user interaction in many cases).
- **Attack Vector:** Network (Remote) / Local (file-based).
## Impact
- **Confidentiality:** High (Attacker can view all sensitive data accessible to the user).
- **Integrity:** High (Attacker can change or delete data and install unauthorized programs).
- **Availability:** High (Attacker can delete data or create new accounts with full rights).
## Remediation
### Patches
Adobe has released security updates for all affected products. Users should update to the following or later versions:
- **AEM:** Update to latest Cloud Service release or 6.5 Service Pack 25+.
- **ColdFusion:** 2025.0.13 / 2023.0.24.
- **Photoshop/Illustrator:** Update to the latest 2025/2026 branches via Creative Cloud.
- **Adobe Commerce:** Apply the August 2026 security patches.
- **Acrobat/Reader:** Update to version 26.002.21901 or higher.
### Workarounds
- **Least Privilege:** Operate systems using accounts with non-administrative rights to limit the impact of code execution.
- **Input Filtering:** For AEM/Commerce, ensure robust WAF rules are in place to block XSS patterns.
## Detection
- **Indicators of Compromise:** Unusual account creation, unauthorized file modifications, or unexpected outbound network traffic from Adobe application services.
- **Detection methods:** Use Endpoint Detection and Response (EDR) to monitor for suspicious child processes spawned by `AcroRd32.exe`, `Photoshop.exe`, or Java-based AEM processes.
## References
- Adobe Security Advisories: hxxps[://]www[.]adobe[.]com/trust/resources/security-advisories[.]html
- CVE Mitre: hxxps[://]cve[.]mitre[.]org/cgi-bin/cvename[.]cgi?name=CVE-2026-81996
- MS-ISAC Advisory: 2026-091