What is the CVSS score of CVE-2026-48348?

CVE-2026-48348 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Adobe Animate are affected by CVE-2026-48348?

Adobe Animate 2023 and 2024 contain a vulnerability (CVE-2026-48348) allowing attackers to execute arbitrary code when users open maliciously crafted files.

How to fix or mitigate CVE-2026-48348?

Within 24 hours, identify all systems running Adobe Animate 2023 or 2024 via endpoint detection tools or asset inventory. Within 7 days, issue urgent guidance prohibiting file opening from untrusted sources, restrict file sharing mechanisms if operationally feasible, and enable monitoring of Animate process execution for suspicious behavior. Within 30 days, monitor Adobe advisory APSB26-83 for patch availability and deploy patches across all affected systems within 48 hours of release; coordinate staged rollout with animation teams to minimize production impact.

Adobe Animate CVE-2026-48348

EUVD-2026-44437 HIGH

Incorrect Authorization (CWE-863)

2026-07-14 adobe

GHSA-g3c2-8rh7-fvm4

Authentication Bypass RCE Adobe Adobe Animate 2023 Adobe Animate 2024

7.7

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.7 HIGH

AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

7.7 HIGH

File must be opened locally so AV:L/UI:R; 'conditions beyond attacker control' justify AC:H; no auth needed (PR:N); code execution escapes the app boundary (S:C) with full C/I/A impact.

3.1 AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 20:56 vuln.today

CVE Published

Jul 14, 2026 - 19:53 nvd

HIGH 7.7

DescriptionCVE.org

Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

AnalysisAI

Arbitrary code execution in Adobe Animate 2023 and 2024 arises from an Incorrect Authorization flaw (CWE-863) that lets a maliciously crafted file run code in the context of the current user. Exploitation requires the victim to open the attacker-supplied file and depends on conditions beyond the attacker's control, and there is no public exploit identified at time of analysis. Adobe self-reported the issue and published fixes in advisory APSB26-83.

Technical ContextAI

Adobe Animate is a desktop authoring application for interactive animation, HTML5/Canvas content, and legacy Flash-format (FLA/XFL) assets. The CPE data pins the affected software to cpe:2.3:a:adobe:adobe_animate_2023 and cpe:2.3:a:adobe:adobe_animate_2024, i.e. the 2023 and 2024 release lines. The root cause is CWE-863 (Incorrect Authorization): the application makes a flawed authorization decision when handling a crafted project/media file, permitting an operation that should be denied. Because the CVSS marks Scope as Changed (S:C), the code execution escapes the vulnerable component's authorization boundary and impacts resources managed by another security authority (the underlying user session/OS), which is why the impact is full code execution as the current user rather than a contained fault.

RemediationAI

Update Adobe Animate 2023 and 2024 to the fixed builds released by Adobe; consult advisory APSB26-83 (https://helpx.adobe.com/security/products/animate/apsb26-83.html) for the exact patched version numbers, as they are not specified in the available data (Patch available per vendor advisory). Because the attack requires a victim to open a malicious file, the most effective compensating control until patching is to avoid opening Animate project or media files (FLA/XFL and imported assets) from untrusted or unverified sources, and to restrict such files at the email/download gateway; the trade-off is workflow friction for teams that legitimately exchange Animate assets. Running Animate under a least-privileged user account limits the blast radius of code execution but does not prevent the exploit. Apply the update on the normal Adobe patch cycle given the local vector and required user interaction.