CVE-2009-3068: Adobe RoboHelp Server unrestricted file upload enables code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityRemote unauthenticated code execution with a 9.3 CVSS score and very high EPSS probability makes this an urgent fix despite the absence of KEV listing.

What it is

Adobe RoboHelp Server 8 fails to restrict file uploads through the RoboHelpServer Servlet (robohelp/server). An attacker can upload a Java Archive file during a PUBLISH action and then request it directly from the robohelp/robo/reserved/web directory, causing server-side code execution. The flaw is remotely reachable and rated 9.3 under CVSS 2.0, so it is a serious risk to any exposed instance.

Impact

Successful exploitation gives the attacker arbitrary code execution in the context of the RoboHelp Server service, effectively full compromise of the host. The CVSS vector shows complete confidentiality, integrity and availability impact.

Attack surface

Reachable over the network through the RoboHelpServer Servlet PUBLISH action; no authentication is required per the CVSS vector (Au:N), though the attack complexity is rated medium. The uploaded file is then retrieved by a direct HTTP request, so no separate user interaction is needed.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.78 probability, 99.55th percentile), indicating strong likelihood of exploitation activity. Public references include a VulnDisco Pack module and ZDI advisory, so exploit tooling is known to exist.

What to do

• Apply the Adobe security bulletin APSB09-14 update for RoboHelp Server 8 as the first action.
• If patching is not immediately possible, restrict or disable the PUBLISH functionality and block access to the robohelp/server servlet.
• Remove execute permissions for uploaded content and ensure the robohelp/robo/reserved/web directory cannot serve or run uploaded files.
• Place the RoboHelp Server behind a reverse proxy or WAF that blocks uploads of executable content such as .jsp or Java Archive files.
• Limit network exposure of the RoboHelp Server to trusted internal clients only.

Detection

• Monitor HTTP requests to the robohelp/server servlet for PUBLISH actions that include file uploads, especially .jsp or archive content.
• Alert on direct GET requests to files under robohelp/robo/reserved/web, particularly paths containing a sessionid subdirectory.
• Watch for newly created files in the RoboHelp web directory and for unexpected Java processes or outbound connections from the server.
• Review web server and application logs for upload-then-access sequences from the same source address.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.