Visualização de leitura

Adobe bets on agentic AI to rewrite SaaS for customer experience

Consumer engagement has been fundamentally changing with the advent of AI agents, forcing a rethink by software-as-a-service (SaaS) companies, and creativity platform provider Adobe is responding by shifting its approach to what it calls ‘Customer Experience Orchestration (CXO).’

Announced today at Adobe Summit, the new Adobe CX Enterprise suite is a pivot to a future defined by agents rather than by software alone, where SaaS companies claim an advantage based on their deep domain expertise and troves of first and third-party data.

The platform brings together customizable and out-of-the-box AI agents, Model Context Protocol (MCP) endpoints, and new intelligence systems built on Adobe’s orchestration engine.

“SaaS is changing, and we are re-architecting so that we can participate in the reimagination, the redefinition of SaaS,” said Adobe VP Sundeep Parsa.

[ More Adobe Summit 2026 coverage ]

Agents executing with guidance from a ‘coach’

Adobe CX Enterprise builds on the company’s Adobe Experience Platform (AEP) Agent Orchestrator, which brought AI agents directly into Adobe apps. Released in 2025, AEP now  powers more 1 trillion experiences annually, according to the company.

AEP remains the “anchor” for Adobe CX Enterprise, which now gives customers the ability to create agent skills (reusable instructions), as well as providing specialized and customizable agents. These can be incorporated into any AI tech stack, including Anthropic’s Claude, OpenAI’s ChatGPT, Google’s Gemini, Microsoft Copilot, Nvidia’s NemoClaw, and others. Developers also have access to Model Context Protocol (MCP) servers and other infrastructure required to build customized use cases.

“We’re going to make sure our applications are not trapped inside our UI layer, that they become composable services available through MCP tool calls or the A2A layer,” Parsa explained. “Customers can tap into what they have and bring that into their own unique processes, be their own UI.”

He emphasized the importance of customer choice. Many enterprises are still grappling with the ‘build or buy’ question; some will prefer to create their own bespoke user interface (UI) layer, while others will have no interest in doing so.

With CX Enterprise, enterprises can use pre-loaded agent skills to build custom workflows, or can launch agents pre-built for specific tasks like workflow optimization (coordinating tasks or automating handoffs) and brand governance (enforcing policies, managing permissions, tracking asset rights). And, a new Adobe CX Enterprise Coworker, to be available in the coming months, will act on specified goals and orchestrate other agents to perform multi-step actions.

For instance, if a marketing team is looking to increase loyalty subscriptions by 3% in the next quarter, the CX Enterprise Coworker will work with other agents to identify relevant audience segments, surface performance insights, create a plan, and develop email copy or visual assets, Parsa noted. Once all this is approved by a human, the Coworker will then help execute the campaign and monitor results.

Whereas previously agents would build an audience, then “go to sleep,” Adobe’s new CX Enterprise Coworker is “always on,” has persistent memory, and can run workflows across weeks, or even full financial quarters if required, Parsa explained. He likened the CX Enterprise Coworker to an American football quarterback, the player who directs the activities on the field, guided by a coach on the sidelines. Coworker’s coach is a marketer or a brand specialist.

“We’re doubling down on this framing of customer experience orchestration,” Parsa says.

Moving to one-on-one personalization

Along with these agentic tools, Adobe is introducing two new intelligence systems: Adobe Brand Intelligence and Adobe Engagement Intelligence.

Brand Intelligence is built on a fine-tuned large language model (LLM) with vision-language capabilities that learns from “qualitative and nuanced inputs” like annotations, feedback cycles, or rejected assets.

“Brand intelligence is going after a much harder problem than ‘a brand kit,’ which is a codification of a CSS style guide,” Parsa explained. The LLM can begin to understand brand sentiment, informed by “data engagement signals and the actual enterprise assets.”

Adobe Engagement Intelligence helps teams decide next best offers, messages, or other actions for targeted customers. This is based on their lifetime interactions, rather than click-throughs or conversions, according to Parsa.

Whereas previously, less was more, “in this world, more is better,” he said, pointing out that the promise of generative AI is producing more material economically. “It’s not creating more for more’s sake, it’s targeted campaigns that get you much closer to one-on-one personalization.”

Early production gains are “massive,” Parsa claimed. This is because troubleshooting and early detection of problems now takes “hours, not days and weeks.”

SaaS companies’ data advantage

Like many SaaS companies grappling with an agent-driven future where pay-per-seat models are becoming less relevant, Adobe is emphasizing its data advantage. Parsa pointed out that more than 20,000 enterprises have built on Adobe’s platform over the years, giving the company enormous amounts of data alongside domain expertise.

Generative AI and AI agents do a good job of understanding the “corpus of world knowledge” and building some “useful capabilities for all of us,” Parsa acknowledged. “But these technologies stop at the enterprise walls, because those are ‘walled gardens.’”

Further, enterprise context is very complicated and spread across numerous applications, he noted. “It’s codified in documents; in some cases just tribal knowledge informs how people function on a day to day basis.” AI agents working on their own (like OpenClaw or Claude Cowork) break in the enterprise because they are “brittle” and not grounded in enterprise data, he said.

“We are a proxy for all of the enterprise context that lives inside our applications,” said Parsa. “We’re going to bring that into the AI layer much faster than a customer restarting that whole process with an AI platform.”

Ultimately, he said, Adobe is “adapting and adjusting” to customer feedback and consumer interaction with brands, as well as with the internet itself, as customer engagement undergoes a dramatic shift in the era of AI. As this unfolds, Parsa emphasized the importance of “open, open, open.”

“We absolutely are going to work with tech partners, we’re going to work with other SaaS companies to make sure that we stay flexible and meet the customer where they are,” he said.

Fake Adobe Reader Download Drops ScreenConnect via Fileless Loader

A deceptive campaign in which attackers distributed a fake Adobe Acrobat Reader installer that secretly deployed ConnectWise’s ScreenConnect via a complex in‑memory execution chain. Although ScreenConnect is a legitimate remote‑access tool, it was repurposed for unauthorized system control and data collection. The attack chain started when victims landed on a phishing site designed to mimic Adobe’s official download page. […]

The post Fake Adobe Reader Download Drops ScreenConnect via Fileless Loader appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Adobe Patches Acrobat Reader 0-Day Vulnerability Exploited in the Wild

Adobe has issued an emergency security patch to neutralize a critical zero-day vulnerability in Acrobat Reader that is currently being exploited in the wild.

Tracked as CVE-2026-34621, this severe flaw enables threat actors to achieve arbitrary code execution on compromised machines.

Because the vulnerability is under active attack, cybersecurity professionals and system administrators are strongly urged to prioritize these updates to defend their organizational networks against potential intrusions.

The core issue relies on Improperly Controlled Modification of Object Prototype Attributes, technically known as Prototype Pollution.

Adobe 0-Day Vulnerability Exploited

Classified under the weakness CWE-1321, this flaw occurs when an application receives input from an upstream component but fails to sanitize modifications to an object’s prototype attributes adequately.

By carefully injecting malicious properties, an attacker can manipulate the application’s underlying logic.

This eventually leads to arbitrary code execution within the current user’s permission context, making it a highly dangerous vector for initial access.

The vulnerability carries a critical severity designation, reflected by its alarming CVSS v3.1 vector string (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

Breaking down these metrics reveals that while the attack can be launched remotely over a network with low complexity and requires absolutely no prior privileges, it relies entirely on user interaction.

To trigger the exploit chain, a targeted victim must be socially engineered into opening a specially crafted, malicious PDF document.

Once the file is opened, the exploit dynamically alters the environment, resulting in a high impact on the system’s confidentiality, integrity, and availability.

The scope of this vulnerability is broad due to the software’s widespread deployment in enterprise environments.

Official documentation confirms that the flaw affects Acrobat Reader versions 24.001.30356, 26.001.21367, and all earlier iterations.

Because PDF documents are a standard medium for business communication, threat actors frequently disguise their malicious payloads as urgent corporate invoices or legal records.

This massive attack surface makes the active exploitation of CVE-2026-34621 a top-priority concern for threat intelligence and incident response teams tracking advanced persistent threats.


To mitigate risks from CVE-2026-34621, organizations should quickly apply the security updates provided in Adobe’s official advisory on GitHub.

Beyond rapid patching, security teams should enhance their email filtering protocols to block suspicious PDF attachments before they reach end-user inboxes.

Regular security awareness training remains crucial, as employees must be reminded of the severe risks tied to opening unsolicited files.

Leveraging robust endpoint detection and response tools will also provide the necessary visibility to intercept post-exploitation anomalies if a malicious file successfully bypasses perimeter defenses.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Adobe Patches Acrobat Reader 0-Day Vulnerability Exploited in the Wild appeared first on Cyber Security News.

Adobe fixes actively exploited Acrobat Reader flaw CVE-2026-34621

Adobe addressed a critical Acrobat Reader vulnerability, tracked as CVE-2026-34621, which is actively exploited to run malicious code.

Adobe released emergency updates to address a critical vulnerability, tracked as CVE-2026-34621 (CVSS score of 8.6), in Adobe Acrobat Reader, which is being actively exploited. The flaw could allow attackers to execute malicious code on affected systems, making prompt patching essential to reduce the risk of compromise.

“Adobe has released a security update for Adobe Acrobat and Reader for Windows and macOS. This update addresses a critical vulnerability. Successful exploitation could lead to arbitrary code execution.” reads the advisory. “Adobe is aware of CVE-2026-34621 being exploited in the wild.”

The vulnerability is an improperly controlled modification of object prototype attributes (‘Prototype Pollution’) that can lead to arbitrary code execution.

Improperly Controlled Modification of Object Prototype Attributes (often called prototype pollution) is a vulnerability mainly in JavaScript where an attacker can modify the base object prototype that many other objects inherit from. In JavaScript, objects can inherit properties from a shared prototype (like Object.prototype). If an application doesn’t properly validate input, an attacker can inject values into this prototype.

Below are the impacted versions:

ProductTrackAffected VersionsPlatform
Acrobat DC Continuous 
26.001.21367 and earlierWindows &  macOS
Acrobat Reader DCContinuous 26.001.21367 and earlierWindows & macOS
Acrobat 2024Classic 2024    24.001.30356 and earlierWindows & macOS

Adobe acknowledged Haifei Li, founder of EXPMON, for reporting this flaw.

Li recently revealed that a zero-day flaw was exploited to run malicious JavaScript via crafted PDFs in Adobe Acrobat Reader. According to the expert, threat actors used the Adobe Reader zero-day for months to deliver a sophisticated PDF exploit.

Adobe has confirmed our findings and has issued an emergency security update for all Adobe Reader (and other affected products) users.https://t.co/10vjsj4MeJ

The underlying exploited zero-day vulnerability has been rated Critical (CVSS 9.6) and is tracked as CVE-2026-34621. It…

— EXPMON (@EXPMON_) April 11, 2026

On March 26, a suspicious PDF was submitted to EXPMON and flagged by its advanced “detection in depth” feature, despite low antivirus detection (13/64 on VirusTotal).

Adobe Reader

The system marked it for manual review, highlighting potential hidden threats. EXPMON identifies exploits through automated alerts, analyst inspection of logs and indicators, and large-scale data analysis. This case shows how advanced detection can uncover sophisticated zero-day activity that traditional tools may miss, though it requires expert analysis to confirm.

The sample analyzed by the Li works as an initial exploit that abuses an unpatched Adobe Reader flaw to run privileged APIs on fully updated systems.

It uses “util.readFileIntoStream()” to read local files and collect sensitive data. Then it calls “RSS.addFeed()” to send stolen data to a remote server and receive more malicious JavaScript.

This lets attackers profile victims, steal information, and decide whether to launch further attacks, including remote code execution or sandbox escape if the target meets specific conditions.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Adobe)

Google, Microsoft, Amazon, and Others Unite Under New Anti-Scam Pact

Google, Meta, Amazon, OpenAI, and others join a new voluntary accord to share signals, tighten safeguards, and fight online scams across platforms.

The post Google, Microsoft, Amazon, and Others Unite Under New Anti-Scam Pact appeared first on TechRepublic.

Microsoft Patch Tuesday, March 2026 Edition

Microsoft Corp. today pushed security updates to fix at least 77 vulnerabilities in its Windows operating systems and other software. There are no pressing “zero-day” flaws this month (compared to February’s five zero-day treat), but as usual some patches may deserve more rapid attention from organizations using Windows. Here are a few highlights from this month’s Patch Tuesday.

Image: Shutterstock, @nwz.

Two of the bugs Microsoft patched today were publicly disclosed previously. CVE-2026-21262 is a weakness that allows an attacker to elevate their privileges on SQL Server 2016 and later editions.

“This isn’t just any elevation of privilege vulnerability, either; the advisory notes that an authorized attacker can elevate privileges to sysadmin over a network,” Rapid7’s Adam Barnett said. “The CVSS v3 base score of 8.8 is just below the threshold for critical severity, since low-level privileges are required. It would be a courageous defender who shrugged and deferred the patches for this one.”

The other publicly disclosed flaw is CVE-2026-26127, a vulnerability in applications running on .NET. Barnett said the immediate impact of exploitation is likely limited to denial of service by triggering a crash, with the potential for other types of attacks during a service reboot.

It would hardly be a proper Patch Tuesday without at least one critical Microsoft Office exploit, and this month doesn’t disappoint. CVE-2026-26113 and CVE-2026-26110 are both remote code execution flaws that can be triggered just by viewing a booby-trapped message in the Preview Pane.

Satnam Narang at Tenable notes that just over half (55%) of all Patch Tuesday CVEs this month are privilege escalation bugs, and of those, a half dozen were rated “exploitation more likely” — across Windows Graphics Component, Windows Accessibility Infrastructure, Windows Kernel, Windows SMB Server and Winlogon. These include:

CVE-2026-24291: Incorrect permission assignments within the Windows Accessibility Infrastructure to reach SYSTEM (CVSS 7.8)
CVE-2026-24294: Improper authentication in the core SMB component (CVSS 7.8)
CVE-2026-24289: High-severity memory corruption and race condition flaw (CVSS 7.8)
CVE-2026-25187: Winlogon process weakness discovered by Google Project Zero (CVSS 7.8).

Ben McCarthy, lead cyber security engineer at Immersive, called attention to CVE-2026-21536, a critical remote code execution bug in a component called the Microsoft Devices Pricing Program. Microsoft has already resolved the issue on their end, and fixing it requires no action on the part of Windows users. But McCarthy says it’s notable as one of the first vulnerabilities identified by an AI agent and officially recognized with a CVE attributed to the Windows operating system. It was discovered by XBOW, a fully autonomous AI penetration testing agent.

XBOW has consistently ranked at or near the top of the Hacker One bug bounty leaderboard for the past year. McCarthy said CVE-2026-21536 demonstrates how AI agents can identify critical 9.8-rated vulnerabilities without access to source code.

“Although Microsoft has already patched and mitigated the vulnerability, it highlights a shift toward AI-driven discovery of complex vulnerabilities at increasing speed,” McCarthy said. “This development suggests AI-assisted vulnerability research will play a growing role in the security landscape.”

Microsoft earlier provided patches to address nine browser vulnerabilities, which are not included in the Patch Tuesday count above. In addition, Microsoft issued a crucial out-of-band (emergency) update on March 2 for Windows Server 2022 to address a certificate renewal issue with passwordless authentication technology Windows Hello for Business.

Separately, Adobe shipped updates to fix 80 vulnerabilities — some of them critical in severity — in a variety of products, including Acrobat and Adobe Commerce. Mozilla Firefox v. 148.0.2 resolves three high severity CVEs.

For a complete breakdown of all the patches Microsoft released today, check out the SANS Internet Storm Center’s Patch Tuesday post. Windows enterprise admins who wish to stay abreast of any news about problematic updates, AskWoody.com is always worth a visit. Please feel free to drop a comment below if you experience any issues apply this month’s patches.

RMM Tools (Syncro, SuperOps, NinjaOne, etc.) Being Distributed Disguised as Video Files

AhnLab SEcurity intelligence Center (ASEC) recently discovered cases of attacks using RMM tools such as Syncro, SuperOps, NinjaOne, and ScreenConnect. Threat actors distributed a PDF file that prompted users to download and run the RMM tool from a disguised distribution page such as Google Drive. The certificate used to sign the malware shows that the […]

FYSA – Adobe Cold Fusion Path Traversal Vulnerability

Summary

Adobe has released a security bulletin (APSB24-107) addressing an arbitrary file system read vulnerability in ColdFusion, a web application server. The vulnerability, identified as CVE-2024-53961, can be exploited to read arbitrary files on the system, potentially leading to unauthorized access and data exposure.

Threat Topography

  • Threat Type: Arbitrary File System Read
  • Industries Impacted: Technology, Software, and Web Development
  • Geolocation: Global
  • Environment Impact: Web servers running ColdFusion 2021 and 2023 are vulnerable

Overview

X-Force Incident Command is monitoring the disclosure of an arbitrary file system read vulnerability in ColdFusion, a web application server, that can be exploited by an attacker to read arbitrary files on the system. The vulnerability, identified as CVE-2024-53961, affects ColdFusion 2021 and 2023. Adobe has provided a patch to address the issue. Adobe has also disclosed that proof of concept exploit code has been published for this vulnerability, making it crucial for organizations to prioritize patching to mitigate the risk of unauthorized access and data exposure. Exploitation has not yet been detected in the wild.

X-Force Incident Command recommends that organizations using ColdFusion review the Adobe bulleting and prioritize patching if running vulnerable versions of the software. Additionally, they should also consider implementing access controls and authentication mechanisms to limit unauthorized access to sensitive data.

X-Force Incident Command will continue to monitor this situation and provide updates as available.

Key Findings

  • The vulnerability, CVE-2024-53961, affects ColdFusion 2021 and 2023.
  • The vulnerability can be exploited to read arbitrary files on the system.
  • Adobe has provided a patch to address the issue.
  • The vulnerability can potentially lead to unauthorized access and data exposure.

Mitigations/Recommendations

  • Apply the patch provided by Adobe as soon as possible.
  • Implement access controls and authentication mechanisms to limit unauthorized access to sensitive data.
  • Monitor systems for any signs of exploitation.
  • Prioritize patching and vulnerability remediation to mitigate the risk of exploitation.
  • Consider implementing file system monitoring and logging to detect and prevent unauthorized file access.

References

The post FYSA – Adobe Cold Fusion Path Traversal Vulnerability appeared first on Security Intelligence.

❌