security issue

Hi ​@Shilnas Yoonus,

Thank you for reaching out, and we appreciate the detail you've shared from your investigation. We understand that alerts of this nature warrant careful review, especially when they involve executables running from a trusted application directory.

The behavior you've described is consistent with the normal operation of the Creative Cloud Content Manager, which is a legitimate Adobe background process that ships with the Creative Cloud desktop app. A few points from our official documentation that map to your observations:

• The Creative Cloud Content Manager uses the node.js framework as part of how it runs, which is why you see node.exe associated with this component.
• On Windows, the Content Manager uses a scheduled task named "Launch Adobe CCXProcess" to trigger CCXProcess.exe on a defined schedule.
• This process operates at user-level privileges, as documented.

Adobe explicitly recommends adding the "Launch Adobe CCXProcess" task to your security software's allow list so it is not mistakenly blocked or restricted. Full details, including the macOS equivalent (com.adobe.ccxprocess.plist), are documented here: https://helpx.adobe.com/x-productkb/global/ccxprocess-os-scheduler.html

For a broader overview of Adobe's background processes and the role each one plays, please refer to: https://helpx.adobe.com/x-productkb/global/adobe-background-processes.html

Regarding the specific hash and the campaign association you mentioned: we are not able to certify individual file hashes through the community forum, and executable names can be reused by unrelated files, so we would recommend verifying on the affected endpoints that the file is the genuine, Adobe-signed copy running from the expected Creative Cloud install directory. For a formal review of the specific hash, or if you observe this activity from a path outside your Creative Cloud install directory, please open a case through Admin Console > Support so our team can look into the details with you directly.

Please let us know how it goes, we're happy to assist further.

Thanks,

^BS

you can replace node.exe with the latest version.