Adobe Acrobat and Reader Use-After-Free Remote Code Execution Vulnerability (CVE-2021-28550) Security Advisory

# Trigger Adobe Acrobat Reader automatic update agent silently
Start-Process -FilePath 'C:\Program Files\Common Files\Adobe\ARM\1.0\Adobelarm.exe' -ArgumentList '/S' -Wait

# Alternatively, deploy the latest MSP patch silently via msiexec
Start-Process msiexec.exe -ArgumentList '/p AcroRdrDCUpd2100120155.msp /qn /norestart' -Wait

# Enforce Adobe Reader Protected Mode (Sandbox) via Registry
New-ItemProperty -Path 'HKCU:\Software\Adobe\Acrobat Reader\DC\Privileged' -Name 'bProtectedMode' -Value 1 -PropertyType DWord -Force

# Disable Acrobat JavaScript to prevent automated exploit execution
New-ItemProperty -Path 'HKCU:\Software\Adobe\Acrobat Reader\DC\JSPrefs' -Name 'bEnableJS' -Value 0 -PropertyType DWord -Force

# Audit installed Adobe Reader versions and flag vulnerable instances
$apps = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' | Where-Object { $_.DisplayName -like '*Adobe Acrobat*' }
if ($apps) {
    foreach ($app in $apps) {
        Write-Output 'Detected: $($app.DisplayName) [Version: $($app.DisplayVersion)]'
        if ($app.DisplayVersion -match '^21\.001\.20150' -or [System.Version]$app.DisplayVersion -lt [System.Version]'21.001.20155') {
            Write-Warning 'VULNERABLE: This version is susceptible to CVE-2021-28550. Immediate update required.'
        } else {
            Write-Output 'SECURE: Patch level is adequate.'
        }
    }
} else {
    Write-Output 'No Adobe Acrobat products detected on this system.'
}