Adobe Bridge CVE-2026-48391

We need to parse the input data and produce a JSON object with the specified fields. The description: "Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."

CVSS 3.1 vector: AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, score 8.2.

CWE-426: Untrusted Search Path.

Tags: RCE, Adobe Bridge.

SSVC: exploitation none, automatable no, technical impact total.

Patch: there is no explicit patch data in the input, but references point to Adobe advisory: https://helpx.adobe.com/security/products/bridge/apsb26-89.html. The version ranges affected: "Adobe Bridge 0 ≤16.0.5" and "Adobe Bridge 0 ≤15.1.6" (probably meaning versions up to but not including? The EUVD says "Adobe Bridge 0 ≤16.0.5" and "0 ≤15.1.6" which is ambiguous — likely affected versions up to, but not including? Actually, it says "0 ≤16.0.5" which might indicate versions from 0 up to 16.0.5, so 16.0.5 is affected. But typical phrasing "versions up to and including 16.0.5". The advisory APSB26-89 might have more details. We'll note that affected products are Adobe Bridge versions up to 16.0.5 and 15.1.6, and presumably patch versions are later: 16.0.6 and 15.1.7? But the advisory isn't fully spelled out in input. We'll extract from the EUVD data: "Adobe Bridge 0 \u226416.0.5" means "Adobe Bridge 0 ≤16.0.5". So version 16.0.5 and earlier are affected. The referenced advisory likely states patched version 16.0.6. So remediation: update to version 16.0.6 (or 15.1.7 for 15.x branch). We'll incorporate that.

We have no KEV status, so no active exploitation confirmed. No POC mentioned, but no explicit statement, so we'll say no public exploit identified. SSVC exploitation none, automatable no, so not easily automated. EPSS not provided, bu