EXPOSURES › CVE-2021-28550
CVE-2021-28550
HIGH ⌖ ON CISA KEV · EXPLOITEDAdobe Acrobat and Reader suffered a use-after-free vulnerability allowing unauthenticated remote code execution.
An unauthenticated attacker could execute arbitrary code in the context of the current user by exploiting a use-after-free flaw in Adobe Acrobat and Reader. This is a critical RCE vulnerability that has been actively exploited in the wild, as indicated by its inclusion in CISA's KEV catalog. DIB organizations must ensure their Adobe products are patched immediately to prevent compromise, as Adobe has a history of shipping critical RCE vulnerabilities in these products.
Shame score — Adobe shipped a critical RCE vulnerability that was actively exploited in the wild, fitting the high-risk track record of repeated critical RCE flaws in Acrobat and Reader.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.
"Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user."
| PRODUCT | STATUS |
|---|---|
| Adobe Acrobat Sign for Government Adobe |
Authorized |
| Adobe Analytics Adobe |
Authorized |
| Adobe Campaign Adobe |
Authorized |
| Adobe Connect Managed Services (ACMS-GC) Adobe |
Authorized |
| Adobe Creative Cloud for Enterprise Adobe |
Authorized |
| Adobe Document Cloud (PDF Services & Adobe Sign) Adobe |
Authorized |
| Adobe Experience Manager Managed Services (AEMMS-GC) Adobe |
Authorized |
| Adobe Learning Manager Adobe |
Authorized |