Loading story…
Adobe patched a local privilege escalation vulnerability in Creative Cloud Desktop for macOS that allowed a local attacker to gain root privileges through the product's privileged helper daemon, /Library/PrivilegedHelperTools/com.adobe.acc.installer. The issue, tracked as CVE-2018-4991 and addressed in Adobe Security Bulletin APSB18-12, affected an XPC method that could launch processes as root while relying on insufficient caller validation.
Technical analysis showed the helper's codesign-based trust check was vulnerable to a time-of-check/time-of-use race condition, allowing an attacker to swap a validated binary before execution or abuse trusted Adobe-signed interpreters such as Node.js to run arbitrary code with elevated privileges. Adobe's fix removed the flawed signature-checking logic and tightened the code-signing requirement used to authorize requests, while the researcher warned that similar patterns might exist in other Adobe components.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
A public blog post described a local privilege escalation vulnerability in Adobe Creative Cloud Desktop on macOS involving the privileged helper daemon com.adobe.acc.installer. The write-up explained the signature-validation bypass and TOCTOU issues, and included a proof-of-concept showing how an attacker could execute code as root using an Adobe-signed Node.js binary.
Adobe issued Security Bulletin APSB18-12 addressing CVE-2018-4991 in Adobe Creative Cloud Desktop. According to the later technical write-up, the fix removed the buggy codesign checker and tightened the codesign requirement string.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe disclosed **CVE-2026-48388**, a high-severity flaw in the **Photoshop Installer** caused by an uncontrolled search path element (`CWE-427`). The issue allows a local attacker to place a malicious DLL or library in a directory searched by the installer so that, when a victim runs the installer, attacker-controlled code is loaded and executed in the context of the current user. The vulnerability is not remotely exploitable on its own, but it does require user interaction and can become more serious when installations are performed with elevated privileges. Advisories warn that the installer may search user-writable locations before legitimate Windows system directories, creating a classic **DLL hijacking** condition. Organizations are being urged to update to the latest Adobe Photoshop release containing the patched installer, obtain installers only from official Adobe sources, remove suspicious libraries from searchable paths, enforce application allowlisting and stricter DLL search-order controls, and use least-privilege accounts during software installation.
Jul 30, 2026
Adobe released security advisories addressing multiple vulnerabilities across a range of its products, including ColdFusion, Adobe Experience Manager (AEM), DNG Software Development Kit (SDK), Acrobat, Acrobat Reader, and the Creative Cloud Desktop Application. The most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged-on user, potentially enabling attackers to install programs, modify or delete data, or create new accounts with full user rights. Affected versions span ColdFusion 2025, 2023, and 2021, AEM Cloud Service and 6.5 LTS, DNG SDK 1.7.0 and prior, Acrobat and Acrobat Reader 2020 and 2024 for both Windows and Mac, and Creative Cloud Desktop Application 6.4.0.361 and earlier. Users and administrators are strongly encouraged to review the official advisories and apply the necessary updates to mitigate risk. Threat intelligence at the time of disclosure indicated no reports of these vulnerabilities being exploited in the wild. The advisories emphasize that users with administrative privileges are at greater risk if exploited, and recommend prompt patching to reduce exposure. Organizations relying on Adobe products for document management, web application development, or digital asset workflows should prioritize these updates to prevent potential compromise through remote code execution vulnerabilities.
Jun 29, 2026
Adobe released security updates for a broad set of products including **Acrobat and Reader**, **Experience Manager**, **Media Encoder**, **Illustrator**, **After Effects**, **Animate**, **InDesign**, **PDFL SDK**, **Connect**, **Photoshop**, **Premiere Pro**, **Bridge**, **FrameMaker**, and multiple **Substance 3D** applications. The advisories cover **165 vulnerabilities**, including **45 rated critical**, with impacts spanning **remote code execution**, **privilege escalation**, **unauthorized access to sensitive data**, **security feature bypass**, and **denial of service**. Many of the most severe issues can be triggered by opening specially crafted files, creating a significant risk for desktop creative tools such as Acrobat, Illustrator, After Effects, and Media Encoder, while some **Adobe Connect** flaws can be exploited remotely without authentication and include reflected **XSS** and privilege-escalation issues. Adobe published product-specific bulletins for affected offerings such as `APSB24-92` for Acrobat, `APSB24-69` for Experience Manager, `APSB24-93` for Media Encoder, `APSB24-94` for Illustrator, and `APSB24-95` for After Effects, and urged customers to upgrade to the patched versions immediately.
Jul 24, 2026