EUVD-2026-73926
GHSA-4pf2-37p5-x5fg
Severity by source
AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Malicious webpage delivery implies network-accessible attack surface (AV:N); all other vendor metrics retained as AC:H, UI:R, and S:C are well-supported by the description.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Photoshop Mobile is affected by a Session Fixation vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain access to sensitive resources. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must interact with a malicious webpage. Scope is changed.
AnalysisAI
Session fixation in Adobe Photoshop Mobile for Android (versions ≤1.6.0.2294 and ≤1.6.0.2299) enables privilege escalation by allowing an attacker to pre-establish or predict a victim's session token before authentication completes. When a victim interacts with an attacker-controlled malicious webpage, the fixed session identifier persists into the authenticated state, granting the attacker access to sensitive Adobe resources with elevated privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to be running a vulnerable version of Adobe Photoshop Mobile for Android (≤1.6.0.2294 or ≤1.6.0.2299) on an Android device. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS score of 7.4 (AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) reflects a locally-initiated attack with high complexity and mandatory user interaction, moderating what would otherwise be a critical impact from C:H/I:H with scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Adobe Photoshop Mobile for Android to a version beyond 1.6.0.2294 or 1.6.0.2299 (as applicable to the installed build track) per Adobe Security Bulletin APSB26-136 at https://helpx.adobe.com/security/products/photoshop/apsb26-136.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Android devices running Photoshop Mobile ≤1.6.0.2299 through mobile device management and block the app from accessing company networks via conditional access policies or firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Session Fixation
View allSession fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID pa
Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session
Tiny File Manager v2.4.7 and below is vulnerable to session fixation. Rated critical severity (CVSS 9.8), this vulnerabi
A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /login
Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation. Rated criti
An issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to exe
A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to ex
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7. Rated critical severity (CVSS 9.8), this vulnerab
Certain NetModule devices allow Limited Session Fixation via PHPSESSID. Rated critical severity (CVSS 9.8), this vulnera
An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Rated critical severity (CVSS 9.8), this v
clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests be
Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." s
Same weakness CWE-384 – Session Fixation
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today