What is the CVSS score of CVE-2026-48350?

CVE-2026-48350 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Adobe Animate are affected by CVE-2026-48350?

Adobe Animate 2023 and 2024 contain a critical path traversal vulnerability (CVE-2026-48350, CVSS 8.6) enabling arbitrary code execution through malicious files.

How to fix or mitigate CVE-2026-48350?

Within 24 hours, inventory all systems running Adobe Animate 2023 or 2024. Within 7 days, deliver security awareness training to affected users about file-opening risks, and implement email and endpoint controls to restrict Animate files from external sources. Within 30 days, monitor vendor advisories for patch availability, contact Adobe for guidance on supported versions and interim security measures, and develop a migration strategy to alternative tools or patched versions when available.

Adobe Animate CVE-2026-48350

EUVD-2026-44436 HIGH

Path Traversal (CWE-22)

2026-07-14 adobe

GHSA-6qvq-7gfm-32m8

Path Traversal RCE Adobe Animate 2023 Adobe Animate 2024

8.6

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

8.6 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.6 HIGH

Local file-parsing bug needs no attacker privileges (PR:N) but requires the victim to open a crafted file (AV:L, UI:R); traversal crosses a boundary (S:C) yielding full code execution (C/I/A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 20:55 vuln.today

CVE Published

Jul 14, 2026 - 19:53 nvd

HIGH 8.6

DescriptionCVE.org

Animate is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to access sensitive files or directories outside the intended restrictions. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

AnalysisAI

Arbitrary code execution in Adobe Animate 2023 and 2024 stems from a path traversal weakness triggered when a victim opens a maliciously crafted file, letting an attacker run code in the context of the current user and reach files or directories outside intended restrictions. The flaw carries a CVSS 3.1 base score of 8.6 with a changed scope, reflecting impact beyond the initially vulnerable component. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious Animate file with traversal path

Delivery

Deliver file to target designer

Exploit

Victim opens file in Animate

Execution

Path traversal escapes restricted directory

Impact

Execute arbitrary code as current user

Access

Craft malicious Animate file with traversal path

Delivery

Deliver file to target designer

Exploit

Victim opens file in Animate

Execution

Path traversal escapes restricted directory

Impact

Execute arbitrary code as current user

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to open a malicious file in a vulnerable Adobe Animate 2023 or 2024 installation - the crafted Animate project/asset file containing the traversal pathname is the exact prerequisite named in the description. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 8.6) describes a local, low-complexity, unauthenticated but user-interaction-dependent vulnerability with high confidentiality, integrity, and availability impact and a changed scope. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a malicious Adobe Animate project or asset file embedding a traversal pathname and delivers it via email, a shared drive, or a compromised download portal to a designer. When the victim opens the file in Animate 2023 or 2024, the path-traversal parsing flaw resolves the attacker-controlled path outside the intended directory and executes code with the victim's privileges. …
Remediation	Apply the update referenced in Adobe Security Bulletin APSB26-83 (https://helpx.adobe.com/security/products/animate/apsb26-83.html); patch available per vendor advisory, though the exact fixed version is not enumerated in the input data, so confirm the target build directly from the bulletin. … Detailed patch versions, workarounds, and compensating controls in full report.