EUVD-2026-35803
GHSA-2c25-6vf9-jx44
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Dreamweaver users
-
DeliveryCraft malicious project/asset file
-
ExploitDeliver via phishing or download
-
ExecutionVictim opens file in Dreamweaver
-
PersistVulnerable third-party component parses payload
-
ImpactExecute code as user with scope change
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | The victim must open a malicious file in Dreamweaver Desktop 21.7 or earlier - this user-interaction requirement is the primary limiter, meaning exploitation cannot occur passively or over the network without convincing a user to launch a crafted document. The CVSS local attack vector (AV:L) confirms exploitation requires the attacker's payload to be processed on the victim's machine rather than reached remotely, so phishing or supplied-file delivery is the realistic route. No authentication is required of the attacker (PR:N), and the changed scope (S:C) indicates the bundled vulnerable component's impact can cross Dreamweaver's trust boundary; the bug is platform-independent across Adobe's supported Dreamweaver builds. |
| Impact | The CVSS vector AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H presents a mixed signal - the local attack vector and required user interaction (opening a malicious file) lower the practical exploitability, but the unauthenticated requirement, low complexity, and changed scope with high impact across CIA push the base score up to 8.6. No EPSS score, KEV listing, or public POC is included in the available data, suggesting this is not currently being mass-exploited; the realistic risk profile resembles a client-side file-format attack delivered via phishing or untrusted download rather than a remotely reachable server vulnerability. Because the affected component is third-party, defenders cannot easily assess true exposure without Adobe disclosing the underlying library - a notable gap when triaging. |
| Exploit ScenarioDerived | An attacker crafts a malicious Dreamweaver project, template, or asset file embedding a payload targeting the vulnerable bundled third-party component and delivers it via phishing email, a compromised design-asset marketplace, or a watering-hole site. When a web designer opens the file in Dreamweaver, the vulnerable component parses the malicious content and executes attacker-supplied code at the user's privilege level, with scope change potentially allowing the impact to extend beyond Dreamweaver's own process boundary. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Arbitrary code execution in Adobe Dreamweaver Desktop 21.7 and earlier stems from a vulnerable third-party component bundled with the application, allowing an attacker to run code in the context of the user who opens a malicious file. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the changed-scope CVSS of 8.6 reflects the potential for the embedded component flaw to break out of Dreamweaver's security boundary.
RemediationAI
Upgrade Dreamweaver Desktop to the fixed release identified in Adobe Security Bulletin APSB26-62 (https://helpx.adobe.com/security/products/dreamweaver/apsb26-62.html) - patch available per vendor advisory, with the exact fixed version listed in that bulletin. Until the update is deployed, instruct users not to open Dreamweaver project files, templates, or assets received from untrusted senders or downloaded from the web, and consider application allowlisting or attachment filtering for Dreamweaver-associated file extensions on endpoints used by design and web-development staff; the trade-off is friction for collaborators who legitimately share project files. Where feasible, restrict Dreamweaver execution to non-privileged user accounts so the changed-scope impact is contained to a least-privileged context.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dreamweaver Desktop is Adobe's WYSIWYG web authoring tool, which bundles numerous third-party libraries to handle rendering, parsing, and project file formats. CWE-1395 (Dependency on Vulnerable Third-Party Component) indicates the root cause is an unpatched upstream library shipped inside the Dreamweaver installer rather than a flaw in Adobe's own code. The CPE string cpe:2.3:a:adobe:dreamweaver_desktop:*:*:*:*:*:*:*:* with the 21.7-and-earlier constraint confirms all currently shipping desktop builds are in scope; Adobe has not publicly named which embedded component is vulnerable in APSB26-62.
Know when Dreamweaver Desktop gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
DescriptionCVE.org
Dreamweaver Desktop versions 21.7 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
Executive ViewAI
Adobe Dreamweaver Desktop versions 21.7 and earlier contain a critical vulnerability in a bundled third-party component that allows arbitrary code execution when users open malicious files, potentially compromising systems of web development teams and designers. With no vendor patch available and a CVSS score of 8.6, this poses significant risk to organizations relying on Dreamweaver for web development workflows. Although no public exploit has been identified, the vulnerability requires only user interaction-opening a malicious file-to achieve full system compromise.
No vendor-released patch identified at time of analysis. Implement interim mitigations: (1) Restrict Dreamweaver access by role to trusted development personnel; (2) Deploy malware detection and content filtering on email and file transfer points; (3) Segment development systems from critical production networks; (4) Mandate user awareness training on file-opening risks; (5) Enable application whitelisting to constrain Dreamweaver execution scope; (6) Monitor process logs for unexpected code execution from Dreamweaver.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Dreamweaver Desktop
View allArbitrary file system read in Adobe Dreamweaver Desktop versions 21.7 and earlier allows attackers to access sensitive f
Arbitrary code execution in Adobe Dreamweaver Desktop versions 21.7 and earlier allows attackers to run code in the cont
Arbitrary file system read in Adobe Dreamweaver Desktop 21.7 and earlier allows a local attacker to access sensitive fil
Incorrect Authorization in Adobe Dreamweaver Desktop 21.7 and earlier enables arbitrary file system reads beyond the app
Exploit-DB