Adobe Premiere Pro CVE-2026-84395

Exploitation requires the Adobe Premiere Pro desktop application to process attacker-supplied content locally (AV:L) - in practice a crafted project or media file loaded by the victim's installation. The CVSS states no user interaction (UI:N) and no authentication (PR:N), but this conflicts with the typical desktop file-open workflow and with the input's flagged environment mismatch, so the real prerequisite (whether a user must open the malicious file) should be confirmed from Adobe APSB26-157. Limiting factors: not remotely reachable over the network without local content processing, impact is integrity/privilege-escalation only (no confidentiality or availability loss), and exploitation depends on the SSRF reaching a reachable internal/privileged endpoint (S:C).

This is a vendor-self-reported (Adobe PSIRT, APSB26-157) SSRF in the Premiere Pro desktop application scored 7.1 with vector AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. The signals are thin and partly contradictory. EPSS is not provided, the CVE is not in CISA KEV, and no proof-of-concept is referenced - so this is no public exploit identified at time of analysis, meaning no evidence of real-world exploitation. The most significant internal inconsistency is that the CVSS declares AV:L (local attack vector) and UI:N (no user interaction), yet the classic exploitation path for a desktop creative application is a victim opening a maliciously crafted project/media file, which would normally imply UI:R; combined with the input's own 'NEEDS REVIEW: environment mismatch' banner, the exact trigger and privilege model should be verified against the Adobe advisory before treating UI:N as authoritative. An SSRF (CWE-918) scored with AV:L rather than the more typical AV:N is also unusual and suggests the request forgery is reachable only via local file/media processing rather than a network-exposed listener. Net assessment: a genuine but non-urgent, medium-severity client-side issue - integrity-only (C:N/A:N) with scope change to internal/back-end resources - not a high-priority remotely-wormable flaw. Prioritize via normal Adobe Creative Cloud patch cadence, not emergency response.

An attacker crafts a malicious project or media asset and delivers it to a Premiere Pro user; when the application processes it, an embedded reference forces the app to issue attacker-directed requests (SSRF) to internal or privileged resources, yielding privilege escalation and unauthorized integrity impact (S:C, I:H). No public exploit code is referenced, and the local attack vector (AV:L) means the attacker needs the target application to process attacker-supplied content rather than reaching a network service directly.