What is the CVSS score of CVE-2026-48344?

CVE-2026-48344 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Adobe Creative Cloud Desktop are affected by CVE-2026-48344?

Adobe Creative Cloud Desktop contains a local privilege escalation vulnerability allowing arbitrary code execution with elevated access.

How to fix or mitigate CVE-2026-48344?

Within 24 hours: audit all systems running Adobe Creative Cloud Desktop and document business-critical deployments; contact Adobe support to confirm patch timeline. Within 7 days: implement compensating controls including restricting local system access via principle of least privilege, disabling Creative Cloud auto-update functionality to reduce exploitation windows, and enabling endpoint detection and response (EDR) monitoring for suspicious privilege escalation activity. Within 30 days: apply vendor patch immediately upon release, or if unavailable, escalate to executives for alternative mitigation strategies such as application restrictions, segmentation, or discontinuation on high-risk systems.

Adobe Creative Cloud Desktop CVE-2026-48344

EUVD-2026-44492 HIGH

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-07-14 adobe

GHSA-q3wj-mx7q-rfv9

RCE Adobe Creative Cloud Desktop

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local unprivileged user must win a non-deterministic TOCTOU race (AV:L, PR:L, AC:H); winning yields full code execution across a privilege boundary (S:C, C/I/A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 21:17 vuln.today

CVE Published

Jul 14, 2026 - 20:21 cve.org

HIGH 7.8

DescriptionCVE.org

Creative Cloud Desktop is affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Local privilege escalation to arbitrary code execution affects the Adobe Creative Cloud Desktop application through a Time-of-check Time-of-use (TOCTOU) race condition, letting a low-privileged local attacker execute code and - because the CVSS scope is changed - impact resources beyond the initial security context. No user interaction is required, but the race is hard to win: exploitation depends on conditions beyond the attacker's control, reflected in the high attack complexity. At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV.

Technical ContextAI

Creative Cloud Desktop is Adobe's management client that installs, updates, and launches Creative Cloud applications (Photoshop, Illustrator, etc.) and typically runs privileged helper/updater components on Windows and macOS. The root cause is CWE-367 (TOCTOU race condition): the application checks a resource's state - such as a file path, permission, or symlink target - and then acts on it in a separate, non-atomic step, leaving a window in which a concurrent attacker can swap the resource for one they control. Because the CPE identifies the affected component as cpe:2.3:a:adobe:creative_cloud_desktop, the flaw sits in the desktop client itself rather than in an individual Creative Cloud app, and the changed scope indicates the race is exploited against a component that operates with a different (higher) privilege than the attacker.

RemediationAI

Patch available per Adobe advisory APSB26-77 (https://helpx.adobe.com/security/products/creative-cloud/apsb26-77.html) - update Creative Cloud Desktop to the fixed version listed there (exact build not present in the supplied data; confirm the patched version from the bulletin before deployment). Because the Creative Cloud Desktop app auto-updates by default, ensuring the built-in updater is enabled and allowed to reach Adobe's update servers is the primary control; in managed enterprise environments push the update via your software-deployment tooling or the Adobe Admin Console. As a compensating control until patching, restrict interactive local logon on affected endpoints to trusted users (the flaw requires an existing low-privileged local account) and monitor for unexpected local processes racing Adobe's privileged updater/helper; note this does not close the race and only reduces the population of potential local attackers. Avoid running untrusted local users on machines with Creative Cloud Desktop installed.