What is the CVSS score of CVE-2026-48272?

CVE-2026-48272 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Creative Cloud Desktop are affected by CVE-2026-48272?

Adobe Creative Cloud Desktop contains a local privilege escalation vulnerability (CVE-2026-48272, CVSS 7.8) that allows low-privileged users to execute arbitrary code through a library search path…

How to fix or mitigate CVE-2026-48272?

Within 24 hours, complete an inventory of all Adobe Creative Cloud Desktop installations and note version numbers currently deployed across creative departments. Within 7 days, deploy compensating controls to all affected systems: enable file integrity monitoring on system directories, implement application execution policies (AppLocker on Windows, code signing requirements on macOS) to restrict library loading, restrict write permissions to %TEMP% and %APPDATA% directories, and enable endpoint detection and response (EDR) with behavioral monitoring for suspicious library load patterns. Within 30 days, establish a formal quarterly vendor advisory monitoring process for Adobe security updates and pre-stage testing infrastructure so any patched version can be deployed within 48 hours of release; document this vulnerability and mitigations in your security architecture review.

Creative Cloud Desktop CVE-2026-48272

EUVD-2026-44493 HIGH

Uncontrolled Search Path Element (CWE-427)

2026-07-14 adobe

GHSA-wq6c-cg2f-6555

RCE Adobe Creative Cloud Desktop

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 21:18 vuln.today

CVE Published

Jul 14, 2026 - 20:21 cve.org

HIGH 7.8

DescriptionCVE.org

Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Local arbitrary code execution in Adobe Creative Cloud Desktop lets a low-privileged user run code in the context of the current user by exploiting an uncontrolled search path (CWE-427) — the class of flaw where an application loads a library or executable from an attacker-influenced directory. Adobe (CVE-2026-48272) rates it CVSS 7.8, but the vector is local with high attack complexity and requires existing low-level privileges, and exploitation depends on conditions beyond the attacker's control. No public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a defense-in-depth patch rather than an emergency.