From a67f14d388ba614feafe1965b38b85142ee92db0 Mon Sep 17 00:00:00 2001 From: Allen Houchins <32207388+allenhouchins@users.noreply.github.com> Date: Wed, 29 Apr 2026 20:30:27 -0500 Subject: [PATCH] Patch Adobe Acrobat automatically on workstation devices (#44316) Add forceful Adobe Acrobat Reader patch policy for all devices Add critical patch policies for Adobe Acrobat Reader on macOS and Windows that enforce immediate automatic updates via install_software: true. This ensures all devices running Adobe Reader are patched without user intervention, addressing the high-risk security profile of PDF readers. Changes: - Add macOS patch policy (adobe-acrobat-reader/darwin) with critical flag - Add Windows patch policy (adobe-acrobat-reader/windows) with critical flag - Register Adobe Acrobat Reader as a fleet_maintained_app for both platforms in workstations.yml ## Summary by CodeRabbit * **New Features** * Adobe Acrobat Reader added as self-service software for macOS and x86 Windows; categorized under Productivity. * Adobe Acrobat Pro added as self-service software for macOS; categorized under Productivity. * Automatic device targeting now surfaces these apps only to hosts that already have them installed. * New critical patch policies for macOS and Windows enable automatic updates with self-service fallback on install failures. --------- Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --- it-and-security/fleets/workstations.yml | 18 ++++++++++++++++++ ...cs-with-fleet-maintained-apps-installed.yml | 10 ++++++++++ ...ws-with-fleet-maintained-apps-installed.yml | 5 +++++ .../policies/patch-fleet-maintained-apps.yml | 18 ++++++++++++++++++ .../policies/patch-fleet-maintained-apps.yml | 9 +++++++++ 5 files changed, 60 insertions(+) diff --git a/it-and-security/fleets/workstations.yml b/it-and-security/fleets/workstations.yml index 8ddf20d601..e7d67fb564 100644 --- a/it-and-security/fleets/workstations.yml +++ b/it-and-security/fleets/workstations.yml @@ -480,6 +480,18 @@ software: - Macs with Cursor installed categories: - Developer tools + - slug: adobe-acrobat-reader/darwin # Adobe Acrobat Reader for macOS + self_service: true + labels_include_any: + - Macs with Adobe Acrobat Reader installed + categories: + - Productivity + - slug: adobe-acrobat-pro/darwin # Adobe Acrobat Pro for macOS + self_service: true + labels_include_any: + - Macs with Adobe Acrobat Pro installed + categories: + - Productivity # Windows apps - slug: 1password/windows # 1Password for Windows self_service: true @@ -526,3 +538,9 @@ software: - "x86 Windows hosts with Visual Studio Code installed" categories: - Developer tools + - slug: adobe-acrobat-reader/windows # Adobe Acrobat Reader for Windows + self_service: true + labels_include_any: + - x86 Windows hosts with Adobe Acrobat Reader installed + categories: + - Productivity diff --git a/it-and-security/lib/all/labels/macs-with-fleet-maintained-apps-installed.yml b/it-and-security/lib/all/labels/macs-with-fleet-maintained-apps-installed.yml index 194b03184c..d1265e058b 100644 --- a/it-and-security/lib/all/labels/macs-with-fleet-maintained-apps-installed.yml +++ b/it-and-security/lib/all/labels/macs-with-fleet-maintained-apps-installed.yml @@ -153,3 +153,13 @@ query: SELECT 1 FROM apps WHERE bundle_identifier = 'com.github.macadmins.Nudge'; label_membership_type: dynamic platform: darwin +- name: Macs with Adobe Acrobat Reader installed + description: macOS hosts with Adobe Acrobat Reader installed + query: SELECT 1 FROM apps WHERE bundle_identifier = 'com.adobe.Reader'; + label_membership_type: dynamic + platform: darwin +- name: Macs with Adobe Acrobat Pro installed + description: macOS hosts with Adobe Acrobat Pro installed + query: SELECT 1 FROM apps WHERE bundle_identifier = 'com.adobe.Acrobat.Pro'; + label_membership_type: dynamic + platform: darwin diff --git a/it-and-security/lib/all/labels/windows-with-fleet-maintained-apps-installed.yml b/it-and-security/lib/all/labels/windows-with-fleet-maintained-apps-installed.yml index 646711d2a5..98378501f8 100644 --- a/it-and-security/lib/all/labels/windows-with-fleet-maintained-apps-installed.yml +++ b/it-and-security/lib/all/labels/windows-with-fleet-maintained-apps-installed.yml @@ -33,3 +33,8 @@ query: SELECT 1 FROM programs WHERE name LIKE 'Microsoft Visual Studio Code%' AND EXISTS (SELECT 1 FROM os_version WHERE arch NOT LIKE 'ARM%'); label_membership_type: dynamic platform: windows +- name: x86 Windows hosts with Adobe Acrobat Reader installed + description: x86 Windows hosts with Adobe Acrobat Reader installed (excludes Adobe Acrobat Pro, which shares the 'Adobe Acrobat (64-bit)' program name on Windows; differentiated by the Reader install_location). + query: SELECT 1 FROM programs WHERE ((name = 'Adobe Acrobat (64-bit)' AND publisher LIKE 'Adobe%' AND install_location LIKE '%\Reader\%') OR (name LIKE 'Adobe Acrobat Reader%' AND publisher LIKE 'Adobe%')) AND EXISTS (SELECT 1 FROM os_version WHERE arch NOT LIKE 'ARM%'); + label_membership_type: dynamic + platform: windows diff --git a/it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml b/it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml index 6130a764bf..a9dccae52b 100644 --- a/it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml +++ b/it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml @@ -248,3 +248,21 @@ install_software: true labels_include_any: - Macs with Nudge installed +- name: macOS - Adobe Acrobat Reader up to date + description: This device may have an outdated version of Adobe Acrobat Reader, posing a critical security risk. Adobe Reader is a frequent target for exploits and must be kept up to date at all times. + resolution: "Adobe Acrobat Reader is managed by IT and should be updated automatically. If you are failing this policy, install the latest version from Self-service. If you are still failing after Refetch completes, drop a note in #help-it." + critical: true + type: patch + fleet_maintained_app_slug: adobe-acrobat-reader/darwin + install_software: true + labels_include_any: + - Macs with Adobe Acrobat Reader installed +- name: macOS - Adobe Acrobat Pro up to date + description: This device may have an outdated version of Adobe Acrobat Pro, posing a critical security risk. Adobe Acrobat is a frequent target for exploits and must be kept up to date at all times. + resolution: "Adobe Acrobat Pro is managed by IT and should be updated automatically. If you are failing this policy, install the latest version from Self-service. If you are still failing after Refetch completes, drop a note in #help-it." + critical: true + type: patch + fleet_maintained_app_slug: adobe-acrobat-pro/darwin + install_software: true + labels_include_any: + - Macs with Adobe Acrobat Pro installed diff --git a/it-and-security/lib/windows/policies/patch-fleet-maintained-apps.yml b/it-and-security/lib/windows/policies/patch-fleet-maintained-apps.yml index 448f4a8549..13550ae80b 100644 --- a/it-and-security/lib/windows/policies/patch-fleet-maintained-apps.yml +++ b/it-and-security/lib/windows/policies/patch-fleet-maintained-apps.yml @@ -55,3 +55,12 @@ install_software: false labels_include_any: - x86 Windows hosts with Visual Studio Code installed +- name: Windows - Adobe Acrobat Reader up to date + description: This device may have an outdated version of Adobe Acrobat Reader, posing a critical security risk. Adobe Reader is a frequent target for exploits and must be kept up to date at all times. + resolution: "Adobe Acrobat Reader is managed by IT and should be updated automatically. If you are failing this policy, install the latest version from Self-service. If you are still failing after Refetch completes, drop a note in #help-it." + critical: true + type: patch + fleet_maintained_app_slug: adobe-acrobat-reader/windows + install_software: true + labels_include_any: + - x86 Windows hosts with Adobe Acrobat Reader installed