EUVD-2026-54650
GHSA-p7gg-5q8m-4jgm
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Local attack vector confirmed by description; no elevated privileges needed for the authorization bypass; only limited write integrity impact with no confidentiality or availability consequence.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
Adobe Genuine Software Integrity Service was affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could have leveraged this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue did not require user interaction, but required the attacker to have access to the local environment the application is installed on.
AnalysisAI
Adobe Genuine Software Integrity Service on local systems exposes an Incorrect Authorization flaw (CWE-863) enabling any local attacker - without elevated privileges - to bypass the service's integrity-verification controls and obtain unauthorized limited write access to areas the service is designed to protect. All tracked versions of the service are affected per the open-ended CPE range published by Adobe. No public exploit or CISA KEV listing has been identified at time of analysis, and exploitation is constrained to the local environment, reducing mass-exploitation risk while remaining a realistic threat from malware, shared-account misuse, or low-privileged insider scenarios.
Technical ContextAI
Adobe Genuine Software Integrity Service is a privileged background process (daemon or Windows service) that validates the authenticity of installed Adobe software, preventing use of pirated or tampered products. Because it must make write-capable decisions about the file system or registry to enforce software integrity, it runs with elevated system-level privileges. CWE-863 (Incorrect Authorization) describes a failure in access control logic - the service does not correctly validate that a requesting entity has sufficient authorization before performing a protected operation, allowing an under-privileged caller to invoke the service's write path without proper entitlement. The affected product identifier cpe:2.3:a:adobe:adobe_genuine_software_integrity_service:*:*:*:*:*:*:*:* uses a full-wildcard version, indicating no version bound has been published, meaning no released version is known to be patched. The EUVD entry (EUVD-2026-54650) corroborates the scope as version 0 ≤ N/A (unbounded).
RemediationAI
No specific patched version has been identified in the available data - the affected version range remains open-ended (version 0 through N/A), indicating either that a patch has not yet been released or that a fixed version was not disclosed in the sourced intelligence. Organizations should monitor Adobe's security bulletin page for an official APSB advisory addressing CVE-2026-71381. As a compensating control, restrict local user account proliferation and enforce the principle of least privilege on endpoints running Adobe software - since exploitation requires local environment access, reducing the number of non-administrative local accounts limits exposure. Endpoint detection and response (EDR) solutions should be configured to alert on unexpected write activity originating from the Adobe Genuine Software Integrity Service process or its child processes. If the service is non-essential in a given deployment, evaluate whether it can be disabled or its network and filesystem access scoped via application control policies - note this may affect Adobe license enforcement functionality. The sole reference available (https://cwe.mitre.org/data/definitions/863.html) describes the vulnerability class but provides no remediation specifics.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today