Adobe Acrobat Reader Vulnerable to Arbitrary Code Execution via User Interaction
CVE-2023-26369

7.8HIGH

Key Information:

Vendor: Adobe
Status: Acrobat Reader
Vendor: CVE Published:; 13 September 2023

Badges

👾 Exploit Exists🟡 Public PoC🦅 CISA Reported📰 News Worthy

What is CVE-2023-26369?

A critical vulnerability in Adobe Acrobat Reader, tracked as CVE-2023-26369, has been actively exploited in the wild. The vulnerability allows for arbitrary code execution when a specially crafted PDF document is opened by the user, impacting both Windows and macOS versions. The severity of the vulnerability is rated 7.8 on the CVSS scoring system. Adobe has released a security update to address this issue, urging administrators to apply the patch as soon as possible. Additionally, two cross-site scripting vulnerabilities in Adobe Connect and Adobe Experience Manager have also been patched in the update. The exploitation of CVE-2023-26369 can lead to arbitrary code execution and poses a significant risk, making it critical for users to update their Adobe Acrobat and Reader installations promptly to mitigate the threat.

CISA has reported CVE-2023-26369

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2023-26369 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

Acrobat Reader 0 <= 20.005.30514

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

cve-2023-26369-poc
Created by dexteon

News Articles

CybersecurityNews

CVE-2023-26369

Adobe PDF Creator Zero-day Vulnerability Exploited in the Wild

As part of its regular Patch Tuesday updates, Adobe has published a security update for Adobe Acrobat PDF and Reader for Windows and macOS.

The Hacker News

CVE-2023-26369

Update Adobe Acrobat and Reader to Patch Actively Exploited Vulnerability

Adobe's September 2023 update addresses a new zero-day vulnerability (CVE-2023-26369) in Acrobat and Reader that attackers are exploiting in the wild.