Adobe
Monthly
Server-side request forgery in Adobe Content Credentials (CAI Content Credentials SDK) allows unauthenticated remote attackers to induce the server to make arbitrary outbound requests, potentially reaching internal services and escalating privileges. The CVSS 3.1 base score is 8.6 (HIGH) with a changed scope, high confidentiality impact, and no integrity or availability impact. Exploitation requires no user interaction; no public exploit code has been identified at time of analysis, and the vendor advisory APSB26-163 should be consulted for fixes.
A signature-verification bypass in the CAI Content Credentials SDK allows an unauthenticated, network-reachable attacker to submit content or a token bearing a forged or tampered cryptographic signature that the SDK's verifier accepts, yielding unauthorized write access to systems that rely on that verification as a trust decision. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) the attack needs no credentials and no user interaction, and the assessment confines impact to integrity only, with no confidentiality or availability loss. The practical exposure is narrow but real: only deployments that actually consume the SDK to validate signatures or claims as a security control are affected, and no public exploit code was identified at time of analysis, so this is a genuine integrity issue rather than an acute emergency.
Improper verification of cryptographic signatures in the CAI Content Credentials SDK allows unauthenticated remote attackers to supply forged or improperly signed content credentials that the SDK accepts as authentic, bypassing the security check and gaining unauthorized write access to whatever the SDK's verification verdict gates. The CVSS 3.1 base score is 7.5 (High) under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - an integrity-only signature-verification bypass (CWE-347) with no confidentiality or availability impact, requiring no authentication and no user interaction. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; real-world risk is highest in deployments that make publishing, authorization, or authenticity decisions solely on the SDK's verification result, and negligible where that result is not treated as a trust boundary.
Denial of service in Adobe's CAI (Content Authenticity Initiative) Content Credentials SDK stems from uncontrolled resource consumption when the library parses attacker-supplied assets or their embedded Content Credentials / C2PA manifest data. The vulnerable path is network-reachable with low attack complexity and, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), requires no authentication and no user interaction, yielding a 7.5 base score with availability-only impact; confidentiality and integrity are unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied, so practical risk is bounded by exposure: because this is an embedded SDK rather than a standalone service, only integrations that feed untrusted, externally sourced content into the parsing/verification path are realistically reachable, while deployments processing only trusted or internally generated assets are not.
Denial-of-service in the CAI Content Credentials SDK allows remote unauthenticated attackers to exhaust system resources by supplying crafted Content Credentials data to an application that parses or verifies it. The issue is availability-only (CVSS 3.1 7.5, CWE-400) with no confidentiality or integrity impact, and no public exploit has been identified at time of analysis. Deployments that do not expose SDK-backed parsing to untrusted input face substantially lower real-world risk.
Improper input validation in Adobe's CAI Content Credentials SDK (advisory APSB26-163) lets remote attackers bypass a security feature and obtain unauthorized write access, effectively allowing modification or forgery of protected content-credential data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) means the flaw is network-reachable, low complexity, unauthenticated, and requires no user interaction, so any application or service that embeds the SDK and exposes its input-processing path to untrusted input is in scope. Impact is confined to integrity (I:H) with no confidentiality or availability loss, and no public exploit code or CISA KEV entry was identified at time of analysis.
Improper verification of cryptographic signatures in Adobe's CAI Content Credentials SDK allows remote, unauthenticated attackers to submit a forged or tampered Content Credentials manifest that the SDK accepts as valid, bypassing a security feature and granting unauthorized write access to credential data (CWE-347; CVSS 3.1 7.5). Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, no credentials and no user interaction are required, and the impact is integrity-only, with confidentiality and availability unaffected; in practice exploitation depends on the vulnerable SDK version being deployed and the consuming application treating signature verification as a trust boundary. This is a moderate-priority integrity issue rather than a top-tier emergency, and no public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
Signature-verification bypass in Adobe Content Credentials SDK allows unauthenticated, network-based attackers to forge or tamper with signed content credentials, bypassing integrity checks to gain unauthorized write access. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) indicates a low-complexity flaw with no user interaction and a pure integrity impact. No public exploit code has been identified at time of analysis, but risk is elevated for applications that rely on the SDK's verification result as a trust or authorization decision. Confirm vulnerable SDK versions against Adobe APSB26-163.
Denial of service in the CAI Content Credentials SDK allows remote, unauthenticated attackers to exhaust system resources by supplying crafted Content Credentials data (such as C2PA manifests or embedded asset metadata) for parsing or verification, with no user interaction required. The CVSS 3.1 base score of 7.5 is driven entirely by availability impact (C:N/I:N/A:H) under a fully remote, low-complexity vector (AV:N/AC:L/PR:N/UI:N), meaning integrity and confidentiality are unaffected. Risk is contingent on exposure: only applications or services that actually ingest untrusted Content Credentials input through a reachable interface are at risk, and no public exploit has been identified at time of analysis. Note that no KEV listing or public proof-of-concept is present in the available intelligence, so the practical threat is best characterized as a reliable availability-degradation vector once a vulnerable processing path is reachable rather than as an observed attack campaign.
Uncontrolled resource consumption in the Adobe CAI Content Credentials SDK lets unauthenticated, remote attackers exhaust system resources and drive an application into denial-of-service by feeding it specially crafted Content Credentials/C2PA data. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the flaw is network-reachable, low-complexity, requires no authentication and no user interaction, and affects availability only - there is no confidentiality or integrity impact, so no data compromise is expected. The practical precondition is that a deployed application actually accepts and processes attacker-supplied content through this SDK's parsing or verification path; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the exact input structure that triggers exhaustion is not documented in the available data.
Application denial-of-service in the Adobe CAI Content Credentials SDK lets unauthenticated remote attackers exhaust system resources by supplying crafted media files or embedded C2PA/Content Credentials manifests that reach the SDK's parsing or verification path, degrading or halting the consuming application (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/A:H; 7.5 High). Impact is confined to availability - no code execution, privilege escalation, or data disclosure - and real-world risk is heavily gated by exposure, since a service must actually ingest untrusted Content Credentials input for the flaw to be reachable; deployments that only process trusted first-party content or run the SDK offline in batch mode face substantially reduced risk. No public exploit identified at time of analysis.
Integer overflow (CWE-190) in the CAI Content Credentials SDK lets unauthenticated remote attackers crash applications that parse externally supplied media or embedded Content Credentials manifests, producing a denial-of-service condition. Affected deployments are those that invoke the SDK against untrusted input - for example services that automatically ingest and verify uploaded or fetched media - while systems that only process trusted, internally generated assets are far less exposed. The vulnerability is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), requires no user interaction, causes availability loss only (no disclosure or modification), and no public exploit code has been identified at time of analysis; the vendor advisory is Adobe APSB26-163.
Improper input validation in the Adobe CAI Content Credentials SDK allows remote, unauthenticated attackers to bypass a security control and obtain unauthorized write access. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, any deployment that exposes the vulnerable SDK input path to attacker-supplied content credentials data is reachable without credentials or user interaction, and the impact is integrity-only (C:N/I:H/A:N), meaning tampering with data rather than disclosure or denial of service. Rated CVSS 7.5 (High) and reported directly by Adobe PSIRT via advisory APSB26-163; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Improper input validation in the CAI Content Credentials SDK (Adobe security bulletin APSB26-163) lets unauthenticated remote attackers bypass the SDK's content-credential validation path and gain unauthorized write access, yielding an integrity-only impact (C:N/I:H/A:N, CVSS 7.5). Any deployment that ingests attacker-supplied or externally sourced credential data and runs the vulnerable SDK version through its parse/verify routine is exposed; no authentication (PR:N) and no user interaction (UI:N) are required per the assessed vector, so a default-configured verification service reachable from the network is sufficient. The practical limiting factor is deployment scope rather than a configuration toggle - the flaw only matters where untrusted content actually flows into the SDK - and there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) at the time of writing, which keeps this an elevated but not top-tier priority.
Improper certificate validation in the CAI Content Credentials SDK allows remote, unauthenticated attackers to bypass security features and gain unauthorized write access (CVSS 7.5, High). Exploitation requires the attacker to present a forged or untrusted certificate that the SDK incorrectly accepts, and no user interaction is needed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Improper certificate validation in Adobe's CAI Content Credentials SDK (Content Credentials SDK) allows remote, unauthenticated attackers to bypass certificate trust checks and gain unauthorized write access, effectively letting them forge or tamper with signed Content Credentials data with no user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5). Impact is bounded to integrity - no confidentiality or availability effect - and only deployments that actually invoke the SDK to validate Content Credentials certificates are exposed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; exploitation in practice requires the attacker to supply crafted signed content or hold a man-in-the-middle position on the certificate validation path.
Improper certificate validation (CWE-295) in the CAI/Adobe Content Credentials SDK allows an unauthenticated remote attacker to have forged or self-signed signing certificates accepted during C2PA manifest verification, bypassing the provenance trust check and enabling unauthorized write (integrity) impact - CVSS 3.1 base 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. No user interaction is required, but exploitation is not automatic: the attacker must get crafted content into a workflow that validates it with the vulnerable SDK, or occupy a trust/transport position from which a malicious certificate is presented, which is narrower in practice than the network-vector score implies. There is no CISA KEV listing and no public exploit identified at time of analysis; impact is confined to integrity, with no confidentiality or availability loss indicated.
Improper input validation in the CAI Content Credentials SDK lets remote, unauthenticated attackers bypass the SDK's security control and obtain unauthorized write access to content-credential data, per Adobe advisory APSB26-163. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) indicates a network-reachable, low-complexity flaw requiring no authentication and no user interaction, with impact confined to integrity - confidentiality and availability are unaffected. Only applications that embed a vulnerable version of the SDK and expose its input-processing/validation path to network-supplied content are affected, and no public exploit code was identified at time of analysis.
Improper input validation in the Adobe CAI Content Credentials SDK lets remote attackers bypass a security feature and gain unauthorized write access to content-credential processing. The flaw is network-reachable, low-complexity, requires no authentication (PR:N) and no user interaction (UI:N), yielding a CVSS 3.1 score of 7.5, but the scored impact is integrity-only (C:N/I:H/A:N) rather than code execution or data disclosure. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; exploitation is contingent on a deployed application embedding the SDK and exposing its C2PA manifest parsing/validation path to attacker-supplied input.
Improper certificate validation in the CAI Content Credentials SDK enables a network-positioned attacker who can intercept TLS connections to bypass security features and gain unauthorized write access. Exploitation requires a man-in-the-middle (MITM) position to supply a forged or invalid certificate that the SDK accepts; the assessed CVSS vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, and although the input CVSS 7.5 vector lists AC:L, our assessment raises attack complexity because the MITM prerequisite limits opportunistic mass exploitation. No user interaction or credentials are needed once the MITM position is obtained. No public exploit identified at time of analysis.
Unauthenticated remote attackers can bypass a security feature in Adobe's CAI Content Credentials SDK and gain unauthorized write access, a 7.5-rated integrity flaw confirmed by Adobe PSIRT. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no credentials and no user interaction are required; the practical precondition is that an application embeds the SDK on a network-reachable code path that processes untrusted, externally supplied content. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the medium-to-high severity and the SDK's role in provenance validation make it a priority for integrations that ingest third-party content.
Improper access control in the CAI Content Credentials SDK allows remote, unauthenticated attackers to bypass a security check and gain unauthorized write access, with no user interaction required (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). The impact is scoped entirely to integrity - the assessed vector shows no confidentiality or availability effect - so practical exposure depends on how much a deploying application trusts Content Credentials data for provenance or security decisions. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; Adobe advisory APSB26-163 is the authoritative source for affected and fixed SDK versions.
Improper access control in the Adobe CAI Content Credentials SDK lets unauthenticated, network-reachable attackers bypass a security check and obtain unauthorized write access to content-credential (provenance) data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) confirms the flaw needs no credentials and no user interaction, and that impact is confined to integrity - there is no confidentiality or availability effect. The practical exposure hinges on integration: this is an SDK, so reachability and real-world impact depend entirely on whether the host application exposes the affected access-controlled operation to attacker-controlled input; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Improper input validation in the CAI Content Credentials SDK allows a remote, unauthenticated attacker to feed crafted input into the SDK's processing path and bypass its integrity and security checks, resulting in unauthorized write access to Content Credentials data. Adobe PSIRT rates the issue CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning no privileges, no authentication, and no user interaction are required, and the impact is confined to integrity - forged or tampered provenance data - with no direct confidentiality or availability loss. Exposure is the limiting factor: since the SDK is a specialized provenance component, real risk depends on whether a downstream application actually accepts untrusted input through the vulnerable code path; there is no public exploit identified at time of analysis and no evidence of active exploitation.
Out-of-bounds write in Adobe Photoshop Desktop (versions 27.10 and earlier, and 26.11.7 and earlier) allows an attacker to execute arbitrary code in the context of the current user when the victim opens a malicious file. The flaw is a local, client-side memory corruption issue (AV:L, UI:R) that requires user interaction but no privileges; no public exploit has been identified at time of analysis. This is a high-severity flaw but not an emergency-tier internet-facing threat due to the human-in-the-loop prerequisite and user-level impact.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user when a victim opens an attacker-supplied file in a vulnerable build - Photoshop 26.11.7 and earlier in the 26.x line, or 27.10 and earlier in the 27.x line. Adobe rates this CVSS 7.8 (High) with a local attack vector (AV:L), no privileges required (PR:N), and mandatory user interaction (UI:R); because the scope is unchanged (S:U), any code that executes runs with the victim's own rights rather than escalating to SYSTEM or root. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw is not listed in CISA KEV; the practical barrier to exploitation is convincing a user to open a crafted file, and default installations are affected with no special configuration required.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows an attacker to execute arbitrary code within the context of the current user when a victim opens a specially crafted file. Affected builds are Photoshop 27.x up to and including 27.10 and the older 26.x branch up to and including 26.11.7; the CVSS 3.1 base score is 7.8 (HIGH) with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning the attack is not network-triggerable and depends on the user opening a malicious document, with no confirmed authentication requirement (PR:N). Exploitation is not confirmed as active and there is no public exploit identified at time of analysis, so real-world risk is driven primarily by social-engineering file delivery and the high confidentiality, integrity, and availability impact that a successful memory-corruption primitive carries on the user's machine.
Out-of-bounds write in Photoshop Desktop can allow arbitrary code execution in the context of the current user when a victim opens a malicious file; this is a genuine but second-tier priority. Affected versions include Photoshop 27.10 and earlier and 26.11.7 and earlier per EUVD. No public exploit identified at time of analysis, and exploitation requires the victim to manually open an attacker-supplied file (AV:L/UI:R/PR:N).
Out-of-bounds write in Adobe Photoshop Desktop running builds at or below 26.11.7 (and at or below 27.10 per ENISA EUVD data) allows an attacker to execute arbitrary code in the context of the user who opens a crafted file. Because exploitation requires the victim to manually open a malicious file on their own system, the attack vector is local-only and depends on user interaction, and any code that runs inherits only the opening user's privileges (no privilege escalation). This is a genuine but operationally moderate-priority issue: no public exploit code and no confirmed active exploitation were identified at time of analysis, and the local plus user-interaction prerequisites materially reduce real-world risk.
Arbitrary code execution in Adobe Photoshop Desktop is possible when a user opens an attacker-supplied file, because an incorrect authorization check (CWE-863) combined with a scope change lets crafted file content escape the application's intended security boundary and run code as the current user. Photoshop builds 27.10 and earlier and 26.11.7 and earlier are affected, and exploitation hinges on convincing a victim to download and open the malicious file (AV:L, PR:N, UI:R), which makes phishing or poisoned shared assets the realistic delivery path rather than any remote or network-facing vector. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a genuinely serious but not emergency-tier issue; a vendor advisory (APSB26-158) is available.
Adobe Photoshop Desktop builds at or below 27.10 and 26.11.7 contain a heap-based buffer overflow that lets an attacker execute arbitrary code in the context of the user who opens a crafted file. The attack is not network-reachable: it follows the local vector (AV:L) and mandatory user interaction (UI:R), so the attacker must first deliver a malicious file and convince the victim to open it in a vulnerable build; no privileges beyond those of that user are obtained. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the independent assessment rates this as a credible but not emergency-tier priority - the primary risk drivers are the reliability of the heap overflow for code execution and the difficulty of the social-engineering prerequisite rather than any observed campaign.
Arbitrary code execution in Adobe Photoshop Desktop (27.x up to and including 27.10, and 26.x up to and including 26.11.7) is possible when a user opens a specially crafted file, because an integer overflow or wraparound during file parsing corrupts memory and lets attacker-controlled code run in the context of the current user. Exploitation is local in nature - the attacker must deliver a malicious file and convince the victim to open it - and, per the CVSS vector (AV:L, PR:N, UI:R, S:U), no prior authentication is needed but no privilege escalation is gained, since code executes only with the victim's own rights. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so the practical risk is a credible but not top-tier priority driven by targeted social engineering rather than opportunistic mass exploitation.
Opening a maliciously crafted file in Adobe Photoshop Desktop (27.10 and earlier, and 26.11.7 and earlier) can trigger a double-free memory-corruption condition that results in arbitrary code execution in the context of the current user. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting that the attacker cannot reach the target over the network and must rely on the victim opening the file, and that code executes only with the privileges of the logged-on user rather than escalating to system level; adversary value is therefore tied to social-engineering delivery of a weaponised document, and there is no public exploit identified at time of analysis. The independent assessment rates this as a credible but not emergency-level priority, consistent with the local attack vector and user-interaction requirement; no CISA KEV listing or public proof-of-concept was supplied in the source data.
Integer overflow (CWE-190) in Adobe Photoshop Desktop lets an attacker achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file. Affected installations are Photoshop 27.x up to and including 27.10 and Photoshop 26.x up to and including 26.11.7, per Adobe advisory APSB26-158 (tracked as EUVD-2026-100691). The vector is local (AV:L) and unauthenticated (PR:N) but gated by mandatory user interaction (UI:R), so there is no network-facing, no-click exposure; no public exploit code or confirmed active exploitation was identified at time of analysis, making this a moderate-priority client-side file-parsing flaw rather than a mass-exploitation emergency.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows an authenticated low-privileged attacker to coerce the application server into issuing requests to internal resources, yielding elevated access and disclosure of data outside the attacker's intended scope. Adobe assigns this a CVSS 3.1 base score of 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N); exploitation is non-deterministic because the vendor states success depends on conditions beyond the attacker's control, and it requires an existing foothold as a low-privileged account. There is no public exploit identified at time of analysis and no CISA KEV listing, so the practical risk profile is that of a moderate-severity, post-authentication SSRF rather than a remotely exploitable unauthenticated flaw.
Improper input validation in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows a high-privileged, already-authenticated attacker with network adjacency to the administrative component to execute arbitrary code in the context of the current user, with full confidentiality, integrity and availability impact and a changed scope (CVSS 8.4). Exploitation is access-gated rather than remotely reachable: the attacker must hold high privileges on the system (PR:H) and be positioned within the administrative network zone where Adobe confines the vulnerable component by default (AV:A), with no user interaction required (UI:N). No public exploit code and no CISA KEV entry have been identified at time of analysis, so this is a high-severity but access-gated issue rather than a drop-everything emergency; because the scope is changed, successful exploitation can affect resources beyond the vulnerable component itself.
Arbitrary code execution in Adobe ColdFusion 2023 and 2025 is achievable through an incorrect authorization flaw (CWE-863) in a component that is, by default, reachable only from the administrative network zone. Exploitation requires two prerequisites confirmed by the assessed vector CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (8.4): the attacker must already be positioned on the adjacent administrative network segment, and must hold a high-privilege ColdFusion account; no user interaction is required and complexity is low once those conditions are met. There is no public exploit identified at time of analysis, so this is a serious but constrained flaw rather than a drop-everything internet-facing emergency - exposure is concentrated in organizations that expose the ColdFusion administrative zone broadly or allow high-privilege accounts to proliferate.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows a low-privileged authenticated attacker to make the ColdFusion server issue requests to internal or otherwise restricted resources, potentially escalating access and reading sensitive data. The vulnerability is rated CVSS 3.1 7.7 with scope changed and high confidentiality impact only; authentication as a low-privileged user is required (PR:L), no user interaction is needed, and no public exploit code was identified at time of analysis.
Unauthenticated remote code execution in Adobe ColdFusion 2023 (versions up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows any remote attacker who can reach the service to execute arbitrary code under the context of the ColdFusion process, with no user interaction required. The CVSS 3.1 base score is a maximum 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and the Scope:Changed metric indicates the attacker's actions can escape the vulnerable component and affect resources beyond its intended security boundary - typically the underlying JVM or host operating system. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV, so this is a high-severity, top-priority patching case driven by the attack vector and impact ratings rather than by confirmed active exploitation; the practical gating factor is network reachability of the exposed ColdFusion endpoint, with WAF-protected or segmented deployments materially harder to attack.
Incorrect authorization in Adobe ColdFusion 2023 (up to and including update 2023.0.25) and ColdFusion 2025 (up to and including update 2025.0.13) lets remote, unauthenticated attackers read contents of sensitive memory without any user interaction. The flaw is rated 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is classified as an authentication bypass (CWE-863), so confidentiality of server-side data is the primary exposure rather than code execution or data modification. No public exploit code or exploitation telemetry has been identified at time of analysis, and no CISA KEV entry is associated, so the practical risk is governed mainly by whether a vulnerable, internet-facing ColdFusion instance is reachable.
Server-side request forgery in Adobe ColdFusion 2025 (up to and including 2025.0.13) and ColdFusion 2023 (up to and including 2023.0.25) allows unauthenticated remote attackers to cause the server to make arbitrary requests, resulting in privilege escalation with the scope changed. This critical vulnerability has a CVSS score of 10.0 and requires no user interaction. No public exploit has been identified at the time of analysis.
Arbitrary code execution in Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13) allows an unauthenticated remote attacker to execute code in the context of the ColdFusion service account. The flaw is a code-injection issue (CWE-94) rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning no credentials, no user interaction, and no unusual complexity are needed - only network reachability of a vulnerable instance. No public exploit code or confirmed active exploitation was identified at time of analysis, but given the severity and the historical targeting of ColdFusion, this warrants expedited patching.
Incorrect authorization in Adobe ColdFusion 2023 (through update 2023.0.25) and ColdFusion 2025 (through update 2025.0.13) allows an authenticated low-privileged attacker to bypass security controls and gain unauthorized write access, enabling modification of protected resources. The CVSS vector indicates network reachability, low attack complexity, no user interaction, and a changed scope, with the primary impact being high integrity loss and low confidentiality loss; no public exploit code or active exploitation has been identified at the time of analysis. This is assessed as a genuinely high-priority issue due to the ease of exploitation once a low-privilege foothold is obtained.
Improper input validation in Adobe ColdFusion 2023 (2023.0 through 2023.0.25) and ColdFusion 2025 (2025.0 through 2025.0.13) can let an unauthenticated remote attacker execute arbitrary code in the context of the affected service, with no user interaction required and a scope change that extends impact beyond the vulnerable component. The assessed CVSS is 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H); the high attack-complexity score reflects that exploitation depends on conditions beyond the attacker's control - a race or specific server state - so successful compromise is not guaranteed on demand. No public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation, but the internet-facing nature of ColdFusion and the fully unauthenticated attack path make this a high-priority patch target.
Arbitrary code execution in Adobe ColdFusion (2023 at or below 2023.0.25, and 2025 at or below 2025.0.13) arises from an incorrect authorization flaw (CWE-863) that allows a low-privileged, authenticated actor to bypass intended access checks and execute code in the context of the current user, with no user interaction required. The vendor-assigned CVSS 3.1 base score is 8.8 (High) with a changed scope (S:C) and high impact across confidentiality, integrity and availability. The vector specifies a local attack path (AV:L) requiring low privileges (PR:L), which is consistent with the assessment that an attacker must already hold a low-privileged ColdFusion account or session; no public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Incorrect authorization in Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13) allows an authenticated, locally-positioned low-privileged attacker to execute arbitrary code in the context of another user, with a changed security scope. The flaw maps to CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (base 8.8): exploitation requires an existing low-privilege account or session plus local access to the server or application context, and it needs no user interaction. No public exploit has been identified at time of analysis, and the high confidentiality, integrity and availability impact is bounded by the fact that an external unauthenticated attacker cannot trigger the issue without first obtaining a foothold and valid low-privilege credentials on an unpatched instance.
Arbitrary file system read in Adobe ColdFusion (2023 releases up to and including 2023.0.25 and 2025 releases up to and including 2025.0.13) is achievable through an XML External Entity (XXE) flaw that lets a remote attacker cause the server to resolve attacker-controlled external entities during XML processing. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C (8.6), meaning the attack is unauthenticated, requires no user interaction, and crosses a security boundary so that disclosed data lies outside the vulnerable component's own scope; impact is confidentiality-only (high) with no integrity or availability effect. No public exploit code and no CISA KEV entry were identified at time of analysis, so risk derives from how many unpatched, network-reachable XML-processing endpoints exist rather than from confirmed active exploitation.
Incorrect authorization (CWE-863) in Adobe ColdFusion 2023 up to 2023.0.25 and ColdFusion 2025 up to 2025.0.13 allows a low-privileged attacker with local access to execute arbitrary code under the context of the current user without user interaction (CVSS 8.8, scope changed). No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, but the Adobe PSIRT 'Authentication Bypass' tag suggests the authorization barrier may be weaker than the PR:L metric implies-defenders should verify the true prerequisite set in APSB26-144. Organizations running affected builds should treat this as a credible priority while confirming whether any authenticated session is truly required.
Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) is possible when a low-privileged authenticated attacker with local or adjacent access exploits an incorrect authorization flaw (CWE-863) to operate outside the intended security scope and run code in the context of the current user. Adobe notes the exploit depends on conditions beyond the attacker's control, which is reflected in the high attack complexity (AC:H), and no user interaction is required (UI:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the combination of authenticated low privilege (PR:L), local vector (AV:L) and high complexity makes reliable mass exploitation unlikely.
Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) lets an attacker who already holds a valid low-privileged account run code in the context of the ColdFusion service, with no interaction required from any user. The underlying defect is improper input validation (CWE-20) reachable over the network, scored CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - the only significant barrier is that the attacker must first authenticate with low privileges, so exposure is greatest where ColdFusion login interfaces are reachable from untrusted networks or where weak or shared low-privilege accounts exist. No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation, which keeps this a high-priority patching item rather than an emergency incident.
Arbitrary code execution is possible in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) through an incorrect authorization check (CWE-863) that lets a low-privileged actor perform actions beyond their granted permissions and reach code execution, with no user interaction required. Rated CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), the flaw is network-reachable and low-complexity, but the PR:L vector means the attacker must already hold a low-privilege position relative to ColdFusion - a valid low-level account or access to a reachable authenticated interface - rather than being fully anonymous; the changed scope indicates impact can extend beyond the initially vulnerable component. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the independent assessment rates it a genuine high-priority finding rather than an inflated score, so it warrants prompt patching given the code-execution impact.
Authenticated low-privileged users on Adobe ColdFusion 2023 through 2023.0.25 and ColdFusion 2025 through 2025.0.13 can exploit an incorrect authorization weakness (CWE-863) to execute arbitrary code in the context of the current user, with changed scope extending impact beyond the vulnerable component. The assessed CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (8.8), so an existing low-privileged account is required and no user interaction is needed; the AV:L value suggests local/console-adjacent access even though the supplied tags include Authentication Bypass and RCE. No public exploit was identified at time of analysis; this is a high-severity, high-priority flaw warranting prompt patching, but the attack-vector and tag conflict should be confirmed with Adobe.
Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) is achievable by a low-privileged, locally positioned attacker who abuses an incorrect authorization flaw to escalate into code execution in the context of the current user. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C, score 8.8) shows the barrier is a valid low-privileged account plus local/session reach to the server rather than unauthenticated network access, and no user interaction is needed. No public exploit code or confirmed active exploitation was identified at time of analysis; the practical risk is real but is gated by the authenticated-plus-local prerequisites, keeping it below a pre-authentication remote code execution scenario.
Incorrect authorization (CWE-863) in Adobe ColdFusion 2023 through update 2023.0.25 and ColdFusion 2025 through update 2025.0.13 enables a low-privileged authenticated attacker to bypass security measures and gain unauthorized write access over the network without user interaction. This moderate-priority vulnerability has a CVSS 3.1 score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), reflecting a scope change and high integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Adobe advisory APSB26-144 provides mitigation guidance.
Arbitrary code execution in Adobe ColdFusion 2023 up to 2023.0.25 and ColdFusion 2025 up to 2025.0.13 allows a low-privileged authenticated remote attacker to inject and execute code in the context of the current user without user interaction, with a CVSS score of 9.9 and scope change. The vulnerable component is reachable over the network, but the attacker must already have a low-privileged foothold (PR:L) rather than fully anonymous access. No public exploit identified at time of analysis; patch available per vendor advisory APSB26-144.
Incorrect authorization handling in Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13) allows an attacker who already holds a low-privileged ColdFusion session or local access to the server to bypass authorization checks and execute arbitrary code in the context of the current user, with no user interaction required. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C) makes clear this is not an anonymous remote flaw despite the 'Authentication Bypass' tag - obtaining a low-privileged account or local foothold is the gating prerequisite, after which complexity is low and impact is high across confidentiality, integrity, and availability with a scope change. There is no public exploit code identified at time of analysis and the issue is not confirmed as actively exploited; a vendor fix is available via Adobe advisory APSB26-144, so systems already patched past 2023.0.25 / 2025.0.13 are not affected.
Unauthenticated denial of service in Adobe ColdFusion 2025 (up to and including 2025.0.13) and ColdFusion 2023 (up to and including 2023.0.25) allows a remote attacker to crash the application by sending crafted input that the server fails to validate properly. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials and no victim interaction are required against a reachable instance, and the impact is confined to availability (C:N/I:N/A:H) - the practical worst case is a service outage rather than data exposure or code execution. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; the dominant risk factor is exposure, since internet-facing or otherwise attacker-reachable ColdFusion instances are at risk while internally segmented deployments sharply reduce reachability.
Unauthenticated remote code execution affects Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13), where the server accepts and stores an uploaded file of a dangerous/executable type and subsequently executes it, giving the attacker code execution in the context of the ColdFusion service account. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 10.0) confirms the flaw is network-reachable, requires no credentials and no user interaction, and has changed scope, so any internet- or network-exposed instance of an affected version that exposes a file-upload-capable endpoint is in scope. At time of analysis, there is no public exploit identified and no confirmation of active exploitation (no CISA KEV listing), but the combination of a 10.0 score, trivial prerequisites, and full confidentiality/integrity/availability impact makes this a top-priority patching target; environments that front ColdFusion with upload filtering or a WAF, or that deny execution in the upload directory, are materially less exposed.
Incorrect authorization in Adobe ColdFusion 2023.0.25 and earlier and 2025.0.13 and earlier allows an authenticated low-privileged attacker to execute arbitrary code in the context of the current user, but only when a victim opens a malicious file supplied by the attacker. The local access vector and required user interaction mean the flaw is not directly reachable through a network request against an exposed server without a prior foothold; no public exploit code or active exploitation has been identified at time of analysis. Adobe has released security advisory APSB26-144 covering affected versions.
Server-side request forgery in Adobe ColdFusion lets remote unauthenticated attackers force the server to issue requests to internal or otherwise protected endpoints, which Adobe flags as potentially escalating privileges across a security boundary. The affected builds are ColdFusion 2023 up to and including 2023.0.25 and ColdFusion 2025 up to and including 2025.0.13; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) confirms no user interaction and no authentication prerequisite, with confidentiality being the only impact dimension assessed. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, so risk derives from high internet/network exposure of affected builds rather than confirmed active exploitation. Real-world severity hinges on what the ColdFusion host can reach internally, since a scope-changed SSRF that touches cloud metadata services or internal admin APIs can yield credential material even without an integrity or availability impact.
Opening an attacker-crafted file in Adobe Photoshop Desktop (versions 26.11.7 and earlier, and 27.10 and earlier) can trigger a heap-based buffer overflow and lead to arbitrary code execution in the context of the current user. The CVSS 3.1 base score of 7.8 (High) reflects full confidentiality, integrity, and availability impact, but is gated by the local attack vector (AV:L) and mandatory user interaction (UI:R) - the victim must actively open the malicious file, so there is no network-facing or unauthenticated-remote exploitation path. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; resulting code execution is bounded by the privileges of the user who opens the file (S:U).
Out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file; affected builds are Photoshop 26.x up to and including 26.11.7 and 27.x up to and including 27.10. The flaw is rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no credentials are required but the attacker must deliver a malicious file locally and the victim must actively open it, so there is no remote or automatic trigger path. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; consistent with the authoritative assessment, this is a credible but not top-tier priority, with memory-corruption exploitation potentially unreliable and code executing only at the current user's privilege level, not elevated. Adobe documents the fix in security bulletin APSB26-158.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted malicious file. The vulnerability affects builds up to and including 27.10 and up to and including 26.11.7 (per ENISA EUVD), and carries a CVSS 3.1 score of 7.8 with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - meaning the attack path is local, no privileges or authentication are required (PR:N), but the victim must actively open the file (UI:R), and any code that runs is confined to that user's rights. No public exploit code and no confirmed active exploitation were identified at time of analysis; it is a genuine but not emergency-grade priority, and Adobe has published security bulletin APSB26-158 (EUVD-2026-100687) covering the fix.
Out-of-bounds write in Adobe Substance 3D Designer 16.0.4 and earlier allows arbitrary code execution in the context of the user who opens a crafted file, meaning an attacker must first deliver a malicious asset and persuade the victim to open it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8). The high confidentiality, integrity and availability impacts are tempered by the local attack vector, the unchanged scope (no privilege escalation beyond the current user) and the mandatory user-interaction step, so this is not a wormable or remotely reachable flaw. No public exploit identified at time of analysis; CISA KEV status is not indicated and the flaw is tracked by Adobe as APSB26-169 / ENISA EUVD-2026-100699.
Out-of-bounds write in Adobe Bridge - versions 15.x through 15.1.8 and 16.x through 16.0.7 - can result in arbitrary code execution in the context of the current user when a victim opens or previews a crafted file. The issue is local in reach (AV:L) and requires attacker-induced user interaction (UI:R), with no authentication or elevated privileges needed (PR:N) and low attack complexity (AC:L) once the file is opened, yielding a CVSS 3.1 base score of 7.8. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), so the practical barrier for an attacker remains the social engineering needed to convince a target on an unpatched version to open the malicious file.
An out-of-bounds write in Adobe Photoshop Desktop (builds up to and including 27.10, and the 26.x line up to and including 26.11.7) lets an attacker corrupt process memory and achieve arbitrary code execution with the privileges of the user who opened the file. Exploitation is not remote: it requires a victim to open a crafted image or project file (CVSS 3.1 base 7.8, AV:L/PR:N/UI:R), so a successful attack depends on social engineering to deliver and convince the user to open the document. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Arbitrary code execution in Adobe Photoshop Desktop (versions 27.10 and earlier, and 26.11.7 and earlier) is possible via an out-of-bounds write when a victim opens a crafted file. Exploitation requires user interaction and is limited to the context of the current user; no public exploit identified at time of analysis. The CVSS score is 7.8, and the vulnerability is not known to be actively exploited.
Unauthenticated remote code execution affects Adobe Experience Manager as a Cloud Service (0 through 2026.9.28187), AEM 6.5 LTS (through SP3), and AEM 6.5 (through 6.5.25) due to an incorrect authorization check (CWE-863) in a network-reachable component. Because the CVSS vector is PR:N/UI:N, attackers need no credentials and no victim interaction - any internet-facing or otherwise reachable affected instance is directly attackable - and the changed scope (S:C) means a successful exploit can compromise resources beyond the vulnerable component itself, including the victim's account or session and the underlying runtime. At the time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, but the maximum 10.0 base score, the authentication-bypass/RCE tagging from the vendor, and the trivial attack preconditions make this a top-priority remediation item despite the absence of observed exploitation.
Privilege escalation in Adobe Experience Manager (AEM) allows an authenticated, low-privileged user - an author or contributor-level account - to abuse an Improper Restriction of XML External Entity Reference (XXE, CWE-611) in XML parsing and thereby read local files and reach internal resources well beyond their intended permissions, crossing a security boundary as reflected by the scope-changed CVSS 9.6 rating. The vector is network-reachable with no user interaction required (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), so the only real precondition is obtaining valid low-tier credentials, which makes author instances and deployments with broadly provisioned low-privilege accounts the highest-risk exposure. No public exploit code has been identified at time of analysis, and builds updated past the affected ranges are not exploitable.
Reflected cross-site scripting in Adobe Experience Manager allows remote attackers to inject malicious scripts into a web page, requiring user interaction (UI:R) and no authentication (PR:N), which could lead to session hijacking or privilege escalation if the victim is an authenticated AEM author or administrator. Affected deployments include AEM 6.5 up to 6.5.25, AEM as a Cloud Service up to 2026.9.28187, and AEM 6.5 LTS up to SP3. The vendor assigned a CVSS of 9.3, but our independent assessment scores it lower (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) because confidentiality and integrity impacts are limited; no public exploit has been identified at time of analysis.
Incorrect authorization in Adobe Experience Manager 6.5 (up to and including 6.5.25) and AEM 6.5 LTS (up to and including 6.5 LTS SP3) lets an authenticated attacker who holds only a low-privileged account break out of their assigned permission level and execute arbitrary code as the current user, with a changed scope that can extend the compromise to the victim's account or session. The flaw is remotely reachable, requires no user interaction, and carries a 9.9 CVSS base score (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), which our independent assessment confirms is a genuine high-priority issue rather than a CVSS-inflated one. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, although the low-privilege prerequisite means any exposed AEM instance that permits self-registration or has a large internal user base is a realistic target.
Unauthenticated remote code execution in Adobe Experience Manager stems from an incorrect authorization check that lets a remote attacker bypass access controls and execute arbitrary code in the context of the current user, with the changed-scope rating indicating impact can extend beyond the vulnerable component (CVSS 3.1 base 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Every unpatched deployment is in scope: AEM 6.5 up to and including 6.5.25, AEM 6.5 LTS up to and including 6.5 LTS SP3, and AEM as a Cloud Service up to and including 2026.9.28187; no credentials or user interaction are required, and the only practical precondition is that the affected author, publish, or endpoint is reachable from the attacker's network. No public exploit code exists and no confirmed active exploitation (CISA KEV) has been recorded at time of analysis, but the authentication-bypass-to-RCE chain plus the maximum severity score make internet-facing, unpatched instances a top remediation priority rather than a high-score/low-real-risk case.
Unauthenticated remote code execution affects Adobe Experience Manager, specifically AEM as a Cloud Service builds up to and including 2026.9.28187, AEM 6.5 LTS up to and including SP3, and AEM 6.5 up to and including 6.5.25, and is rooted in an incorrect authorization check (CWE-863) that carries a maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Because the defective access-control decision itself is the entry point, a remote attacker needs only network reachability, no credentials, and no user interaction, and the changed scope (S:C) means the resulting arbitrary code execution in the current user's context can be leveraged to gain elevated access or control over a victim's account or session beyond the vulnerable component. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the unauthenticated, no-interaction exploitation profile places internet-exposed AEM instances at top-priority risk, with network isolation (VPN, WAF, non-exposed tiers) and the affected-version boundaries as the main mitigating factors.
Blind XPath/XML injection in Adobe Experience Manager 6.5 (versions 6.5.0 through 6.5.25) allows a low-privileged, authenticated attacker to bypass security controls and read content they should not be able to access, with limited unauthorized write capability. The flaw is network-reachable, requires no user interaction, and carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), reflecting high confidentiality impact but only low integrity impact and no availability impact; the CVSS vector confirms the attacker must hold a valid low-privileged account (PR:L), so unauthenticated outsiders cannot exploit it directly. No public exploit code or confirmed active exploitation was identified at time of analysis, and Adobe has published a vendor security bulletin (apsb26-152) covering the issue.
SQL injection in Adobe Experience Manager 6.5 (through 6.5.25) allows an authenticated, low-privileged attacker to bypass security controls and gain unauthorized read and limited write access to backend data. The flaw is due to improper neutralization of special elements used in SQL commands (CWE-89), and exploitation requires no user interaction. No public exploit code or active exploitation has been identified, and the need for valid low-privilege credentials and the limited version range make this a moderate-priority issue rather than an emergency.
Arbitrary file-system write in Adobe Experience Manager 6.5 (through 6.5.25) and AEM 6.5 LTS (through LTS SP3) allows an authenticated low-privileged attacker to place files in unauthorized locations on the host by sending a crafted request that manipulates a pathname and escapes the intended directory. No user interaction is required and attack complexity is low, but the attacker must already hold a valid low-privilege AEM account and be able to reach the instance over the network; the assessed vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) shows a scope change with high integrity impact and no direct confidentiality or availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a credentialed post-authentication persistence and integrity risk rather than an opportunistic internet-wide exploit, though it is a credible escalation step for anyone who already has a foothold in AEM.
Stored cross-site scripting in Adobe Experience Manager allows attackers to inject malicious scripts into vulnerable form fields, which execute in a victim's browser when they visit the poisoned page, potentially leading to session hijacking or elevated access. Affected versions include AEM 6.5 LTS up to SP3 and AEM 6.5 up to 6.5.25. The vendor CVSS score is 9.3 (PR:N), but independent assessment indicates the injection step may require access to a form-authoring or submission surface (PR:L) and victim interaction is mandatory; no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5 LTS (through SP3) and AEM 6.5 (through 6.5.25) lets an attacker persist a malicious JavaScript payload into a vulnerable form field, which then executes in the browser of any user who views the page rendering that field, yielding high confidentiality and integrity impact with a scope change into the victim's session. Adobe rates this Critical at CVSS 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), while independent assessment scores it lower on the privilege axis at PR:L, reflecting the practical requirement that the attacker be able to submit or store content before triggering execution; all versions converge on UI:R, since the payload remains dormant until a victim browses the affected page. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though the high CVSS score and the authoring-console reachability of AEM make prompt patching per Adobe advisory APSB26-152 advisable.
Arbitrary code execution in Adobe Experience Manager (AEM) allows an attacker with a high-privilege account (e.g., administrator or author-level) to run malicious code on the server, potentially affecting resources beyond the vulnerable component due to changed scope. The improper input validation flaw (CWE-20) affects AEM as a Cloud Service ≤2026.9.28187, AEM 6.5 ≤6.5.25, and AEM 6.5 LTS ≤6.5 LTS SP3, and requires network access but no user interaction. No public exploit or active exploitation has been identified at time of analysis; patches are available per the Adobe advisory (apsb26-152).
Improper input validation in Adobe Experience Manager 6.5 (versions up to and including 6.5.25) allows an attacker who already holds a valid low-privilege account or session to execute arbitrary code in the context of the current user, and because the flaw crosses a security scope boundary it can lead to elevated access or takeover of the victim's account or session. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 9.9) confirms the issue is remotely reachable with low attack complexity and no user interaction, but it explicitly requires an authenticated low-privilege position - it is not exploitable by a fully unauthenticated attacker. No public exploit code has been identified at time of analysis and the vulnerability has not been confirmed as actively exploited (no CISA KEV listing); Adobe has published advisory APSB26-152 covering the fix.
OS command injection in Adobe Experience Manager 6.5 (through 6.5.25) and AEM 6.5 LTS (through SP3) allows an authenticated, low-privileged attacker to run arbitrary operating-system commands in the context of the current user, with changed scope (S:C) meaning the injected command executes outside the application's own security authority on the host. Rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), the exploitation bar is low attack complexity with no user interaction; the only meaningful constraint is the need for a valid low-privilege AEM session, which is a very low bar in multi-user AEM author environments where content authors and other non-admin accounts are routinely issued. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); no EPSS score was supplied with the source data. This is a genuine high-priority vulnerability rather than a CVSS-inflated paper risk, and the specific vulnerable feature or injectable parameter is not named in the advisory summary, so patch validation and hunting should be prioritized on affected instances.
Arbitrary code execution in Adobe Dimension 4.1.8 and earlier occurs through a CWE-426 untrusted search path flaw where a local attacker can pre-stage a malicious DLL or shared library in a directory the application searches ahead of the trusted location, which is then loaded when a victim launches Dimension. Exploitation requires local file-write access and user interaction, and no public exploit or CISA KEV listing has been identified at time of analysis. The vendor CVSS base score is 8.6 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), indicating high impact despite the local and interaction prerequisites.
Arbitrary code execution in Adobe Dimension 4.1.8 and earlier is possible when a user opens a crafted project or asset file containing improperly neutralized input that is then processed during the application's page/content generation (CWE-79). The attack surface is local only: an attacker must first place malicious content on the victim's machine and persuade them to launch Dimension, but success yields full confidentiality, integrity, and availability impact with a changed scope, meaning the resulting code execution can affect resources beyond Dimension's own boundary. The issue is scored CVSS 3.1 base 8.6 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and no public exploit code or confirmed active exploitation has been identified at time of analysis.
An out-of-bounds write (CWE-787) in Adobe Dimension 4.1.8 and earlier allows arbitrary code execution at the privilege level of the user who opens a specially crafted file, such as a malicious Dimension project or imported 3D asset. Exploitation is local and depends entirely on victim interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) - the attacker must deliver a file the user then opens, so this is not a remotely triggerable, wormable flaw; no public exploit code identified at time of analysis and the CVE is not in CISA KEV. The practical risk is genuine but operationally constrained by the mandatory user action, the local delivery requirement, and the shrinking installed base of what our assessment describes as a discontinued product.
An out-of-bounds read (CWE-125) in Adobe Substance 3D Stager 3.1.8 and earlier can lead to arbitrary code execution in the context of the current user when a victim opens a crafted file with the application. Exploitation is local in vector terms (AV:L) and requires user interaction (UI:R), so an attacker must first deliver a malicious asset and persuade the target to open it; code execution is confined to the victim's privileges because the scope is unchanged (S:U). Rated CVSS 7.8 (High), with no public exploit identified at time of analysis and no CISA KEV listing, making this a genuine but not top-tier priority that should be handled through routine patch cycles rather than emergency response.
Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier allows arbitrary code execution in the context of the current user when the victim opens a maliciously crafted 3D project or asset file. The attack path is local and requires user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8), with no network-facing trigger and no privilege escalation beyond the rights of the user who opens the file. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; this is a genuine but not emergency-grade priority, where the practical risk is driven by social engineering that convinces a Stager user to open attacker-supplied content.
An out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier lets an attacker achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted 3D project or asset file. The attack is local in nature (AV:L) and depends entirely on user interaction (UI:R) - the victim must be socially engineered into opening the malicious file - and the resulting code runs with the victim's own privileges rather than elevated rights (no privileges are required per PR:N). At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV, so this is assessed as a moderate-priority, not emergency, memory-corruption flaw whose primary risk is targeted, file-based social engineering against individual Substance 3D Stager workstations.
An out-of-bounds write (CWE-787) in Adobe FrameMaker allows an attacker to corrupt memory and potentially execute arbitrary code with the privileges of the user who opens a maliciously crafted document. Affected builds are FrameMaker 2026 at or below 18.0.0.206 and FrameMaker 2022 at or below 17.0.9.866. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) confirms there is no network or unauthenticated trigger: exploitation depends on social engineering a victim into opening a booby-trapped file, and any code that runs is confined to the current user's rights with no privilege escalation. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, making this a credible but not emergency-tier patching priority.
Arbitrary code execution in Adobe FrameMaker is possible via a heap-based buffer overflow (CWE-122) that is triggered when the victim opens a specially crafted file. The CVSS:3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (score 7.8) indicates the flaw is local to the desktop application, requires user interaction, needs no prior authentication, and gives the attacker only the privileges of the user who opens the document. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation; the main risk is social engineering against FrameMaker users.
Arbitrary code execution in Adobe FrameMaker is possible when a user opens a maliciously crafted file, due to a use-after-free (CWE-416) memory corruption flaw. The vulnerability requires user interaction (UI:R) and is local (AV:L), meaning an attacker must deliver the file to the victim, who then opens it; no authentication is needed (PR:N). While no public exploit code has been identified, the issue is rated CVSS 7.8 and is considered a genuine but not emergency-grade priority; Adobe has published a security bulletin (APSB26-172) with remediation guidance.
Server-side request forgery in Adobe Content Credentials (CAI Content Credentials SDK) allows unauthenticated remote attackers to induce the server to make arbitrary outbound requests, potentially reaching internal services and escalating privileges. The CVSS 3.1 base score is 8.6 (HIGH) with a changed scope, high confidentiality impact, and no integrity or availability impact. Exploitation requires no user interaction; no public exploit code has been identified at time of analysis, and the vendor advisory APSB26-163 should be consulted for fixes.
A signature-verification bypass in the CAI Content Credentials SDK allows an unauthenticated, network-reachable attacker to submit content or a token bearing a forged or tampered cryptographic signature that the SDK's verifier accepts, yielding unauthorized write access to systems that rely on that verification as a trust decision. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) the attack needs no credentials and no user interaction, and the assessment confines impact to integrity only, with no confidentiality or availability loss. The practical exposure is narrow but real: only deployments that actually consume the SDK to validate signatures or claims as a security control are affected, and no public exploit code was identified at time of analysis, so this is a genuine integrity issue rather than an acute emergency.
Improper verification of cryptographic signatures in the CAI Content Credentials SDK allows unauthenticated remote attackers to supply forged or improperly signed content credentials that the SDK accepts as authentic, bypassing the security check and gaining unauthorized write access to whatever the SDK's verification verdict gates. The CVSS 3.1 base score is 7.5 (High) under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - an integrity-only signature-verification bypass (CWE-347) with no confidentiality or availability impact, requiring no authentication and no user interaction. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; real-world risk is highest in deployments that make publishing, authorization, or authenticity decisions solely on the SDK's verification result, and negligible where that result is not treated as a trust boundary.
Denial of service in Adobe's CAI (Content Authenticity Initiative) Content Credentials SDK stems from uncontrolled resource consumption when the library parses attacker-supplied assets or their embedded Content Credentials / C2PA manifest data. The vulnerable path is network-reachable with low attack complexity and, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), requires no authentication and no user interaction, yielding a 7.5 base score with availability-only impact; confidentiality and integrity are unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied, so practical risk is bounded by exposure: because this is an embedded SDK rather than a standalone service, only integrations that feed untrusted, externally sourced content into the parsing/verification path are realistically reachable, while deployments processing only trusted or internally generated assets are not.
Denial-of-service in the CAI Content Credentials SDK allows remote unauthenticated attackers to exhaust system resources by supplying crafted Content Credentials data to an application that parses or verifies it. The issue is availability-only (CVSS 3.1 7.5, CWE-400) with no confidentiality or integrity impact, and no public exploit has been identified at time of analysis. Deployments that do not expose SDK-backed parsing to untrusted input face substantially lower real-world risk.
Improper input validation in Adobe's CAI Content Credentials SDK (advisory APSB26-163) lets remote attackers bypass a security feature and obtain unauthorized write access, effectively allowing modification or forgery of protected content-credential data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) means the flaw is network-reachable, low complexity, unauthenticated, and requires no user interaction, so any application or service that embeds the SDK and exposes its input-processing path to untrusted input is in scope. Impact is confined to integrity (I:H) with no confidentiality or availability loss, and no public exploit code or CISA KEV entry was identified at time of analysis.
Improper verification of cryptographic signatures in Adobe's CAI Content Credentials SDK allows remote, unauthenticated attackers to submit a forged or tampered Content Credentials manifest that the SDK accepts as valid, bypassing a security feature and granting unauthorized write access to credential data (CWE-347; CVSS 3.1 7.5). Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, no credentials and no user interaction are required, and the impact is integrity-only, with confidentiality and availability unaffected; in practice exploitation depends on the vulnerable SDK version being deployed and the consuming application treating signature verification as a trust boundary. This is a moderate-priority integrity issue rather than a top-tier emergency, and no public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
Signature-verification bypass in Adobe Content Credentials SDK allows unauthenticated, network-based attackers to forge or tamper with signed content credentials, bypassing integrity checks to gain unauthorized write access. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) indicates a low-complexity flaw with no user interaction and a pure integrity impact. No public exploit code has been identified at time of analysis, but risk is elevated for applications that rely on the SDK's verification result as a trust or authorization decision. Confirm vulnerable SDK versions against Adobe APSB26-163.
Denial of service in the CAI Content Credentials SDK allows remote, unauthenticated attackers to exhaust system resources by supplying crafted Content Credentials data (such as C2PA manifests or embedded asset metadata) for parsing or verification, with no user interaction required. The CVSS 3.1 base score of 7.5 is driven entirely by availability impact (C:N/I:N/A:H) under a fully remote, low-complexity vector (AV:N/AC:L/PR:N/UI:N), meaning integrity and confidentiality are unaffected. Risk is contingent on exposure: only applications or services that actually ingest untrusted Content Credentials input through a reachable interface are at risk, and no public exploit has been identified at time of analysis. Note that no KEV listing or public proof-of-concept is present in the available intelligence, so the practical threat is best characterized as a reliable availability-degradation vector once a vulnerable processing path is reachable rather than as an observed attack campaign.
Uncontrolled resource consumption in the Adobe CAI Content Credentials SDK lets unauthenticated, remote attackers exhaust system resources and drive an application into denial-of-service by feeding it specially crafted Content Credentials/C2PA data. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the flaw is network-reachable, low-complexity, requires no authentication and no user interaction, and affects availability only - there is no confidentiality or integrity impact, so no data compromise is expected. The practical precondition is that a deployed application actually accepts and processes attacker-supplied content through this SDK's parsing or verification path; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the exact input structure that triggers exhaustion is not documented in the available data.
Application denial-of-service in the Adobe CAI Content Credentials SDK lets unauthenticated remote attackers exhaust system resources by supplying crafted media files or embedded C2PA/Content Credentials manifests that reach the SDK's parsing or verification path, degrading or halting the consuming application (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/A:H; 7.5 High). Impact is confined to availability - no code execution, privilege escalation, or data disclosure - and real-world risk is heavily gated by exposure, since a service must actually ingest untrusted Content Credentials input for the flaw to be reachable; deployments that only process trusted first-party content or run the SDK offline in batch mode face substantially reduced risk. No public exploit identified at time of analysis.
Integer overflow (CWE-190) in the CAI Content Credentials SDK lets unauthenticated remote attackers crash applications that parse externally supplied media or embedded Content Credentials manifests, producing a denial-of-service condition. Affected deployments are those that invoke the SDK against untrusted input - for example services that automatically ingest and verify uploaded or fetched media - while systems that only process trusted, internally generated assets are far less exposed. The vulnerability is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), requires no user interaction, causes availability loss only (no disclosure or modification), and no public exploit code has been identified at time of analysis; the vendor advisory is Adobe APSB26-163.
Improper input validation in the Adobe CAI Content Credentials SDK allows remote, unauthenticated attackers to bypass a security control and obtain unauthorized write access. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, any deployment that exposes the vulnerable SDK input path to attacker-supplied content credentials data is reachable without credentials or user interaction, and the impact is integrity-only (C:N/I:H/A:N), meaning tampering with data rather than disclosure or denial of service. Rated CVSS 7.5 (High) and reported directly by Adobe PSIRT via advisory APSB26-163; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Improper input validation in the CAI Content Credentials SDK (Adobe security bulletin APSB26-163) lets unauthenticated remote attackers bypass the SDK's content-credential validation path and gain unauthorized write access, yielding an integrity-only impact (C:N/I:H/A:N, CVSS 7.5). Any deployment that ingests attacker-supplied or externally sourced credential data and runs the vulnerable SDK version through its parse/verify routine is exposed; no authentication (PR:N) and no user interaction (UI:N) are required per the assessed vector, so a default-configured verification service reachable from the network is sufficient. The practical limiting factor is deployment scope rather than a configuration toggle - the flaw only matters where untrusted content actually flows into the SDK - and there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) at the time of writing, which keeps this an elevated but not top-tier priority.
Improper certificate validation in the CAI Content Credentials SDK allows remote, unauthenticated attackers to bypass security features and gain unauthorized write access (CVSS 7.5, High). Exploitation requires the attacker to present a forged or untrusted certificate that the SDK incorrectly accepts, and no user interaction is needed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Improper certificate validation in Adobe's CAI Content Credentials SDK (Content Credentials SDK) allows remote, unauthenticated attackers to bypass certificate trust checks and gain unauthorized write access, effectively letting them forge or tamper with signed Content Credentials data with no user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5). Impact is bounded to integrity - no confidentiality or availability effect - and only deployments that actually invoke the SDK to validate Content Credentials certificates are exposed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; exploitation in practice requires the attacker to supply crafted signed content or hold a man-in-the-middle position on the certificate validation path.
Improper certificate validation (CWE-295) in the CAI/Adobe Content Credentials SDK allows an unauthenticated remote attacker to have forged or self-signed signing certificates accepted during C2PA manifest verification, bypassing the provenance trust check and enabling unauthorized write (integrity) impact - CVSS 3.1 base 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. No user interaction is required, but exploitation is not automatic: the attacker must get crafted content into a workflow that validates it with the vulnerable SDK, or occupy a trust/transport position from which a malicious certificate is presented, which is narrower in practice than the network-vector score implies. There is no CISA KEV listing and no public exploit identified at time of analysis; impact is confined to integrity, with no confidentiality or availability loss indicated.
Improper input validation in the CAI Content Credentials SDK lets remote, unauthenticated attackers bypass the SDK's security control and obtain unauthorized write access to content-credential data, per Adobe advisory APSB26-163. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) indicates a network-reachable, low-complexity flaw requiring no authentication and no user interaction, with impact confined to integrity - confidentiality and availability are unaffected. Only applications that embed a vulnerable version of the SDK and expose its input-processing/validation path to network-supplied content are affected, and no public exploit code was identified at time of analysis.
Improper input validation in the Adobe CAI Content Credentials SDK lets remote attackers bypass a security feature and gain unauthorized write access to content-credential processing. The flaw is network-reachable, low-complexity, requires no authentication (PR:N) and no user interaction (UI:N), yielding a CVSS 3.1 score of 7.5, but the scored impact is integrity-only (C:N/I:H/A:N) rather than code execution or data disclosure. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; exploitation is contingent on a deployed application embedding the SDK and exposing its C2PA manifest parsing/validation path to attacker-supplied input.
Improper certificate validation in the CAI Content Credentials SDK enables a network-positioned attacker who can intercept TLS connections to bypass security features and gain unauthorized write access. Exploitation requires a man-in-the-middle (MITM) position to supply a forged or invalid certificate that the SDK accepts; the assessed CVSS vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, and although the input CVSS 7.5 vector lists AC:L, our assessment raises attack complexity because the MITM prerequisite limits opportunistic mass exploitation. No user interaction or credentials are needed once the MITM position is obtained. No public exploit identified at time of analysis.
Unauthenticated remote attackers can bypass a security feature in Adobe's CAI Content Credentials SDK and gain unauthorized write access, a 7.5-rated integrity flaw confirmed by Adobe PSIRT. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no credentials and no user interaction are required; the practical precondition is that an application embeds the SDK on a network-reachable code path that processes untrusted, externally supplied content. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the medium-to-high severity and the SDK's role in provenance validation make it a priority for integrations that ingest third-party content.
Improper access control in the CAI Content Credentials SDK allows remote, unauthenticated attackers to bypass a security check and gain unauthorized write access, with no user interaction required (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). The impact is scoped entirely to integrity - the assessed vector shows no confidentiality or availability effect - so practical exposure depends on how much a deploying application trusts Content Credentials data for provenance or security decisions. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; Adobe advisory APSB26-163 is the authoritative source for affected and fixed SDK versions.
Improper access control in the Adobe CAI Content Credentials SDK lets unauthenticated, network-reachable attackers bypass a security check and obtain unauthorized write access to content-credential (provenance) data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) confirms the flaw needs no credentials and no user interaction, and that impact is confined to integrity - there is no confidentiality or availability effect. The practical exposure hinges on integration: this is an SDK, so reachability and real-world impact depend entirely on whether the host application exposes the affected access-controlled operation to attacker-controlled input; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Improper input validation in the CAI Content Credentials SDK allows a remote, unauthenticated attacker to feed crafted input into the SDK's processing path and bypass its integrity and security checks, resulting in unauthorized write access to Content Credentials data. Adobe PSIRT rates the issue CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning no privileges, no authentication, and no user interaction are required, and the impact is confined to integrity - forged or tampered provenance data - with no direct confidentiality or availability loss. Exposure is the limiting factor: since the SDK is a specialized provenance component, real risk depends on whether a downstream application actually accepts untrusted input through the vulnerable code path; there is no public exploit identified at time of analysis and no evidence of active exploitation.
Out-of-bounds write in Adobe Photoshop Desktop (versions 27.10 and earlier, and 26.11.7 and earlier) allows an attacker to execute arbitrary code in the context of the current user when the victim opens a malicious file. The flaw is a local, client-side memory corruption issue (AV:L, UI:R) that requires user interaction but no privileges; no public exploit has been identified at time of analysis. This is a high-severity flaw but not an emergency-tier internet-facing threat due to the human-in-the-loop prerequisite and user-level impact.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user when a victim opens an attacker-supplied file in a vulnerable build - Photoshop 26.11.7 and earlier in the 26.x line, or 27.10 and earlier in the 27.x line. Adobe rates this CVSS 7.8 (High) with a local attack vector (AV:L), no privileges required (PR:N), and mandatory user interaction (UI:R); because the scope is unchanged (S:U), any code that executes runs with the victim's own rights rather than escalating to SYSTEM or root. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw is not listed in CISA KEV; the practical barrier to exploitation is convincing a user to open a crafted file, and default installations are affected with no special configuration required.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows an attacker to execute arbitrary code within the context of the current user when a victim opens a specially crafted file. Affected builds are Photoshop 27.x up to and including 27.10 and the older 26.x branch up to and including 26.11.7; the CVSS 3.1 base score is 7.8 (HIGH) with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning the attack is not network-triggerable and depends on the user opening a malicious document, with no confirmed authentication requirement (PR:N). Exploitation is not confirmed as active and there is no public exploit identified at time of analysis, so real-world risk is driven primarily by social-engineering file delivery and the high confidentiality, integrity, and availability impact that a successful memory-corruption primitive carries on the user's machine.
Out-of-bounds write in Photoshop Desktop can allow arbitrary code execution in the context of the current user when a victim opens a malicious file; this is a genuine but second-tier priority. Affected versions include Photoshop 27.10 and earlier and 26.11.7 and earlier per EUVD. No public exploit identified at time of analysis, and exploitation requires the victim to manually open an attacker-supplied file (AV:L/UI:R/PR:N).
Out-of-bounds write in Adobe Photoshop Desktop running builds at or below 26.11.7 (and at or below 27.10 per ENISA EUVD data) allows an attacker to execute arbitrary code in the context of the user who opens a crafted file. Because exploitation requires the victim to manually open a malicious file on their own system, the attack vector is local-only and depends on user interaction, and any code that runs inherits only the opening user's privileges (no privilege escalation). This is a genuine but operationally moderate-priority issue: no public exploit code and no confirmed active exploitation were identified at time of analysis, and the local plus user-interaction prerequisites materially reduce real-world risk.
Arbitrary code execution in Adobe Photoshop Desktop is possible when a user opens an attacker-supplied file, because an incorrect authorization check (CWE-863) combined with a scope change lets crafted file content escape the application's intended security boundary and run code as the current user. Photoshop builds 27.10 and earlier and 26.11.7 and earlier are affected, and exploitation hinges on convincing a victim to download and open the malicious file (AV:L, PR:N, UI:R), which makes phishing or poisoned shared assets the realistic delivery path rather than any remote or network-facing vector. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a genuinely serious but not emergency-tier issue; a vendor advisory (APSB26-158) is available.
Adobe Photoshop Desktop builds at or below 27.10 and 26.11.7 contain a heap-based buffer overflow that lets an attacker execute arbitrary code in the context of the user who opens a crafted file. The attack is not network-reachable: it follows the local vector (AV:L) and mandatory user interaction (UI:R), so the attacker must first deliver a malicious file and convince the victim to open it in a vulnerable build; no privileges beyond those of that user are obtained. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the independent assessment rates this as a credible but not emergency-tier priority - the primary risk drivers are the reliability of the heap overflow for code execution and the difficulty of the social-engineering prerequisite rather than any observed campaign.
Arbitrary code execution in Adobe Photoshop Desktop (27.x up to and including 27.10, and 26.x up to and including 26.11.7) is possible when a user opens a specially crafted file, because an integer overflow or wraparound during file parsing corrupts memory and lets attacker-controlled code run in the context of the current user. Exploitation is local in nature - the attacker must deliver a malicious file and convince the victim to open it - and, per the CVSS vector (AV:L, PR:N, UI:R, S:U), no prior authentication is needed but no privilege escalation is gained, since code executes only with the victim's own rights. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so the practical risk is a credible but not top-tier priority driven by targeted social engineering rather than opportunistic mass exploitation.
Opening a maliciously crafted file in Adobe Photoshop Desktop (27.10 and earlier, and 26.11.7 and earlier) can trigger a double-free memory-corruption condition that results in arbitrary code execution in the context of the current user. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting that the attacker cannot reach the target over the network and must rely on the victim opening the file, and that code executes only with the privileges of the logged-on user rather than escalating to system level; adversary value is therefore tied to social-engineering delivery of a weaponised document, and there is no public exploit identified at time of analysis. The independent assessment rates this as a credible but not emergency-level priority, consistent with the local attack vector and user-interaction requirement; no CISA KEV listing or public proof-of-concept was supplied in the source data.
Integer overflow (CWE-190) in Adobe Photoshop Desktop lets an attacker achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file. Affected installations are Photoshop 27.x up to and including 27.10 and Photoshop 26.x up to and including 26.11.7, per Adobe advisory APSB26-158 (tracked as EUVD-2026-100691). The vector is local (AV:L) and unauthenticated (PR:N) but gated by mandatory user interaction (UI:R), so there is no network-facing, no-click exposure; no public exploit code or confirmed active exploitation was identified at time of analysis, making this a moderate-priority client-side file-parsing flaw rather than a mass-exploitation emergency.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows an authenticated low-privileged attacker to coerce the application server into issuing requests to internal resources, yielding elevated access and disclosure of data outside the attacker's intended scope. Adobe assigns this a CVSS 3.1 base score of 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N); exploitation is non-deterministic because the vendor states success depends on conditions beyond the attacker's control, and it requires an existing foothold as a low-privileged account. There is no public exploit identified at time of analysis and no CISA KEV listing, so the practical risk profile is that of a moderate-severity, post-authentication SSRF rather than a remotely exploitable unauthenticated flaw.
Improper input validation in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows a high-privileged, already-authenticated attacker with network adjacency to the administrative component to execute arbitrary code in the context of the current user, with full confidentiality, integrity and availability impact and a changed scope (CVSS 8.4). Exploitation is access-gated rather than remotely reachable: the attacker must hold high privileges on the system (PR:H) and be positioned within the administrative network zone where Adobe confines the vulnerable component by default (AV:A), with no user interaction required (UI:N). No public exploit code and no CISA KEV entry have been identified at time of analysis, so this is a high-severity but access-gated issue rather than a drop-everything emergency; because the scope is changed, successful exploitation can affect resources beyond the vulnerable component itself.
Arbitrary code execution in Adobe ColdFusion 2023 and 2025 is achievable through an incorrect authorization flaw (CWE-863) in a component that is, by default, reachable only from the administrative network zone. Exploitation requires two prerequisites confirmed by the assessed vector CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (8.4): the attacker must already be positioned on the adjacent administrative network segment, and must hold a high-privilege ColdFusion account; no user interaction is required and complexity is low once those conditions are met. There is no public exploit identified at time of analysis, so this is a serious but constrained flaw rather than a drop-everything internet-facing emergency - exposure is concentrated in organizations that expose the ColdFusion administrative zone broadly or allow high-privilege accounts to proliferate.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows a low-privileged authenticated attacker to make the ColdFusion server issue requests to internal or otherwise restricted resources, potentially escalating access and reading sensitive data. The vulnerability is rated CVSS 3.1 7.7 with scope changed and high confidentiality impact only; authentication as a low-privileged user is required (PR:L), no user interaction is needed, and no public exploit code was identified at time of analysis.
Unauthenticated remote code execution in Adobe ColdFusion 2023 (versions up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows any remote attacker who can reach the service to execute arbitrary code under the context of the ColdFusion process, with no user interaction required. The CVSS 3.1 base score is a maximum 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and the Scope:Changed metric indicates the attacker's actions can escape the vulnerable component and affect resources beyond its intended security boundary - typically the underlying JVM or host operating system. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV, so this is a high-severity, top-priority patching case driven by the attack vector and impact ratings rather than by confirmed active exploitation; the practical gating factor is network reachability of the exposed ColdFusion endpoint, with WAF-protected or segmented deployments materially harder to attack.
Incorrect authorization in Adobe ColdFusion 2023 (up to and including update 2023.0.25) and ColdFusion 2025 (up to and including update 2025.0.13) lets remote, unauthenticated attackers read contents of sensitive memory without any user interaction. The flaw is rated 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is classified as an authentication bypass (CWE-863), so confidentiality of server-side data is the primary exposure rather than code execution or data modification. No public exploit code or exploitation telemetry has been identified at time of analysis, and no CISA KEV entry is associated, so the practical risk is governed mainly by whether a vulnerable, internet-facing ColdFusion instance is reachable.
Server-side request forgery in Adobe ColdFusion 2025 (up to and including 2025.0.13) and ColdFusion 2023 (up to and including 2023.0.25) allows unauthenticated remote attackers to cause the server to make arbitrary requests, resulting in privilege escalation with the scope changed. This critical vulnerability has a CVSS score of 10.0 and requires no user interaction. No public exploit has been identified at the time of analysis.
Arbitrary code execution in Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13) allows an unauthenticated remote attacker to execute code in the context of the ColdFusion service account. The flaw is a code-injection issue (CWE-94) rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning no credentials, no user interaction, and no unusual complexity are needed - only network reachability of a vulnerable instance. No public exploit code or confirmed active exploitation was identified at time of analysis, but given the severity and the historical targeting of ColdFusion, this warrants expedited patching.
Incorrect authorization in Adobe ColdFusion 2023 (through update 2023.0.25) and ColdFusion 2025 (through update 2025.0.13) allows an authenticated low-privileged attacker to bypass security controls and gain unauthorized write access, enabling modification of protected resources. The CVSS vector indicates network reachability, low attack complexity, no user interaction, and a changed scope, with the primary impact being high integrity loss and low confidentiality loss; no public exploit code or active exploitation has been identified at the time of analysis. This is assessed as a genuinely high-priority issue due to the ease of exploitation once a low-privilege foothold is obtained.
Improper input validation in Adobe ColdFusion 2023 (2023.0 through 2023.0.25) and ColdFusion 2025 (2025.0 through 2025.0.13) can let an unauthenticated remote attacker execute arbitrary code in the context of the affected service, with no user interaction required and a scope change that extends impact beyond the vulnerable component. The assessed CVSS is 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H); the high attack-complexity score reflects that exploitation depends on conditions beyond the attacker's control - a race or specific server state - so successful compromise is not guaranteed on demand. No public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation, but the internet-facing nature of ColdFusion and the fully unauthenticated attack path make this a high-priority patch target.
Arbitrary code execution in Adobe ColdFusion (2023 at or below 2023.0.25, and 2025 at or below 2025.0.13) arises from an incorrect authorization flaw (CWE-863) that allows a low-privileged, authenticated actor to bypass intended access checks and execute code in the context of the current user, with no user interaction required. The vendor-assigned CVSS 3.1 base score is 8.8 (High) with a changed scope (S:C) and high impact across confidentiality, integrity and availability. The vector specifies a local attack path (AV:L) requiring low privileges (PR:L), which is consistent with the assessment that an attacker must already hold a low-privileged ColdFusion account or session; no public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Incorrect authorization in Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13) allows an authenticated, locally-positioned low-privileged attacker to execute arbitrary code in the context of another user, with a changed security scope. The flaw maps to CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (base 8.8): exploitation requires an existing low-privilege account or session plus local access to the server or application context, and it needs no user interaction. No public exploit has been identified at time of analysis, and the high confidentiality, integrity and availability impact is bounded by the fact that an external unauthenticated attacker cannot trigger the issue without first obtaining a foothold and valid low-privilege credentials on an unpatched instance.
Arbitrary file system read in Adobe ColdFusion (2023 releases up to and including 2023.0.25 and 2025 releases up to and including 2025.0.13) is achievable through an XML External Entity (XXE) flaw that lets a remote attacker cause the server to resolve attacker-controlled external entities during XML processing. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C (8.6), meaning the attack is unauthenticated, requires no user interaction, and crosses a security boundary so that disclosed data lies outside the vulnerable component's own scope; impact is confidentiality-only (high) with no integrity or availability effect. No public exploit code and no CISA KEV entry were identified at time of analysis, so risk derives from how many unpatched, network-reachable XML-processing endpoints exist rather than from confirmed active exploitation.
Incorrect authorization (CWE-863) in Adobe ColdFusion 2023 up to 2023.0.25 and ColdFusion 2025 up to 2025.0.13 allows a low-privileged attacker with local access to execute arbitrary code under the context of the current user without user interaction (CVSS 8.8, scope changed). No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, but the Adobe PSIRT 'Authentication Bypass' tag suggests the authorization barrier may be weaker than the PR:L metric implies-defenders should verify the true prerequisite set in APSB26-144. Organizations running affected builds should treat this as a credible priority while confirming whether any authenticated session is truly required.
Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) is possible when a low-privileged authenticated attacker with local or adjacent access exploits an incorrect authorization flaw (CWE-863) to operate outside the intended security scope and run code in the context of the current user. Adobe notes the exploit depends on conditions beyond the attacker's control, which is reflected in the high attack complexity (AC:H), and no user interaction is required (UI:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the combination of authenticated low privilege (PR:L), local vector (AV:L) and high complexity makes reliable mass exploitation unlikely.
Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) lets an attacker who already holds a valid low-privileged account run code in the context of the ColdFusion service, with no interaction required from any user. The underlying defect is improper input validation (CWE-20) reachable over the network, scored CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - the only significant barrier is that the attacker must first authenticate with low privileges, so exposure is greatest where ColdFusion login interfaces are reachable from untrusted networks or where weak or shared low-privilege accounts exist. No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation, which keeps this a high-priority patching item rather than an emergency incident.
Arbitrary code execution is possible in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) through an incorrect authorization check (CWE-863) that lets a low-privileged actor perform actions beyond their granted permissions and reach code execution, with no user interaction required. Rated CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), the flaw is network-reachable and low-complexity, but the PR:L vector means the attacker must already hold a low-privilege position relative to ColdFusion - a valid low-level account or access to a reachable authenticated interface - rather than being fully anonymous; the changed scope indicates impact can extend beyond the initially vulnerable component. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the independent assessment rates it a genuine high-priority finding rather than an inflated score, so it warrants prompt patching given the code-execution impact.
Authenticated low-privileged users on Adobe ColdFusion 2023 through 2023.0.25 and ColdFusion 2025 through 2025.0.13 can exploit an incorrect authorization weakness (CWE-863) to execute arbitrary code in the context of the current user, with changed scope extending impact beyond the vulnerable component. The assessed CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (8.8), so an existing low-privileged account is required and no user interaction is needed; the AV:L value suggests local/console-adjacent access even though the supplied tags include Authentication Bypass and RCE. No public exploit was identified at time of analysis; this is a high-severity, high-priority flaw warranting prompt patching, but the attack-vector and tag conflict should be confirmed with Adobe.
Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) is achievable by a low-privileged, locally positioned attacker who abuses an incorrect authorization flaw to escalate into code execution in the context of the current user. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C, score 8.8) shows the barrier is a valid low-privileged account plus local/session reach to the server rather than unauthenticated network access, and no user interaction is needed. No public exploit code or confirmed active exploitation was identified at time of analysis; the practical risk is real but is gated by the authenticated-plus-local prerequisites, keeping it below a pre-authentication remote code execution scenario.
Incorrect authorization (CWE-863) in Adobe ColdFusion 2023 through update 2023.0.25 and ColdFusion 2025 through update 2025.0.13 enables a low-privileged authenticated attacker to bypass security measures and gain unauthorized write access over the network without user interaction. This moderate-priority vulnerability has a CVSS 3.1 score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), reflecting a scope change and high integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Adobe advisory APSB26-144 provides mitigation guidance.
Arbitrary code execution in Adobe ColdFusion 2023 up to 2023.0.25 and ColdFusion 2025 up to 2025.0.13 allows a low-privileged authenticated remote attacker to inject and execute code in the context of the current user without user interaction, with a CVSS score of 9.9 and scope change. The vulnerable component is reachable over the network, but the attacker must already have a low-privileged foothold (PR:L) rather than fully anonymous access. No public exploit identified at time of analysis; patch available per vendor advisory APSB26-144.
Incorrect authorization handling in Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13) allows an attacker who already holds a low-privileged ColdFusion session or local access to the server to bypass authorization checks and execute arbitrary code in the context of the current user, with no user interaction required. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C) makes clear this is not an anonymous remote flaw despite the 'Authentication Bypass' tag - obtaining a low-privileged account or local foothold is the gating prerequisite, after which complexity is low and impact is high across confidentiality, integrity, and availability with a scope change. There is no public exploit code identified at time of analysis and the issue is not confirmed as actively exploited; a vendor fix is available via Adobe advisory APSB26-144, so systems already patched past 2023.0.25 / 2025.0.13 are not affected.
Unauthenticated denial of service in Adobe ColdFusion 2025 (up to and including 2025.0.13) and ColdFusion 2023 (up to and including 2023.0.25) allows a remote attacker to crash the application by sending crafted input that the server fails to validate properly. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials and no victim interaction are required against a reachable instance, and the impact is confined to availability (C:N/I:N/A:H) - the practical worst case is a service outage rather than data exposure or code execution. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; the dominant risk factor is exposure, since internet-facing or otherwise attacker-reachable ColdFusion instances are at risk while internally segmented deployments sharply reduce reachability.
Unauthenticated remote code execution affects Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13), where the server accepts and stores an uploaded file of a dangerous/executable type and subsequently executes it, giving the attacker code execution in the context of the ColdFusion service account. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 10.0) confirms the flaw is network-reachable, requires no credentials and no user interaction, and has changed scope, so any internet- or network-exposed instance of an affected version that exposes a file-upload-capable endpoint is in scope. At time of analysis, there is no public exploit identified and no confirmation of active exploitation (no CISA KEV listing), but the combination of a 10.0 score, trivial prerequisites, and full confidentiality/integrity/availability impact makes this a top-priority patching target; environments that front ColdFusion with upload filtering or a WAF, or that deny execution in the upload directory, are materially less exposed.
Incorrect authorization in Adobe ColdFusion 2023.0.25 and earlier and 2025.0.13 and earlier allows an authenticated low-privileged attacker to execute arbitrary code in the context of the current user, but only when a victim opens a malicious file supplied by the attacker. The local access vector and required user interaction mean the flaw is not directly reachable through a network request against an exposed server without a prior foothold; no public exploit code or active exploitation has been identified at time of analysis. Adobe has released security advisory APSB26-144 covering affected versions.
Server-side request forgery in Adobe ColdFusion lets remote unauthenticated attackers force the server to issue requests to internal or otherwise protected endpoints, which Adobe flags as potentially escalating privileges across a security boundary. The affected builds are ColdFusion 2023 up to and including 2023.0.25 and ColdFusion 2025 up to and including 2025.0.13; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) confirms no user interaction and no authentication prerequisite, with confidentiality being the only impact dimension assessed. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, so risk derives from high internet/network exposure of affected builds rather than confirmed active exploitation. Real-world severity hinges on what the ColdFusion host can reach internally, since a scope-changed SSRF that touches cloud metadata services or internal admin APIs can yield credential material even without an integrity or availability impact.
Opening an attacker-crafted file in Adobe Photoshop Desktop (versions 26.11.7 and earlier, and 27.10 and earlier) can trigger a heap-based buffer overflow and lead to arbitrary code execution in the context of the current user. The CVSS 3.1 base score of 7.8 (High) reflects full confidentiality, integrity, and availability impact, but is gated by the local attack vector (AV:L) and mandatory user interaction (UI:R) - the victim must actively open the malicious file, so there is no network-facing or unauthenticated-remote exploitation path. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; resulting code execution is bounded by the privileges of the user who opens the file (S:U).
Out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file; affected builds are Photoshop 26.x up to and including 26.11.7 and 27.x up to and including 27.10. The flaw is rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no credentials are required but the attacker must deliver a malicious file locally and the victim must actively open it, so there is no remote or automatic trigger path. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; consistent with the authoritative assessment, this is a credible but not top-tier priority, with memory-corruption exploitation potentially unreliable and code executing only at the current user's privilege level, not elevated. Adobe documents the fix in security bulletin APSB26-158.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted malicious file. The vulnerability affects builds up to and including 27.10 and up to and including 26.11.7 (per ENISA EUVD), and carries a CVSS 3.1 score of 7.8 with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - meaning the attack path is local, no privileges or authentication are required (PR:N), but the victim must actively open the file (UI:R), and any code that runs is confined to that user's rights. No public exploit code and no confirmed active exploitation were identified at time of analysis; it is a genuine but not emergency-grade priority, and Adobe has published security bulletin APSB26-158 (EUVD-2026-100687) covering the fix.
Out-of-bounds write in Adobe Substance 3D Designer 16.0.4 and earlier allows arbitrary code execution in the context of the user who opens a crafted file, meaning an attacker must first deliver a malicious asset and persuade the victim to open it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8). The high confidentiality, integrity and availability impacts are tempered by the local attack vector, the unchanged scope (no privilege escalation beyond the current user) and the mandatory user-interaction step, so this is not a wormable or remotely reachable flaw. No public exploit identified at time of analysis; CISA KEV status is not indicated and the flaw is tracked by Adobe as APSB26-169 / ENISA EUVD-2026-100699.
Out-of-bounds write in Adobe Bridge - versions 15.x through 15.1.8 and 16.x through 16.0.7 - can result in arbitrary code execution in the context of the current user when a victim opens or previews a crafted file. The issue is local in reach (AV:L) and requires attacker-induced user interaction (UI:R), with no authentication or elevated privileges needed (PR:N) and low attack complexity (AC:L) once the file is opened, yielding a CVSS 3.1 base score of 7.8. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), so the practical barrier for an attacker remains the social engineering needed to convince a target on an unpatched version to open the malicious file.
An out-of-bounds write in Adobe Photoshop Desktop (builds up to and including 27.10, and the 26.x line up to and including 26.11.7) lets an attacker corrupt process memory and achieve arbitrary code execution with the privileges of the user who opened the file. Exploitation is not remote: it requires a victim to open a crafted image or project file (CVSS 3.1 base 7.8, AV:L/PR:N/UI:R), so a successful attack depends on social engineering to deliver and convince the user to open the document. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Arbitrary code execution in Adobe Photoshop Desktop (versions 27.10 and earlier, and 26.11.7 and earlier) is possible via an out-of-bounds write when a victim opens a crafted file. Exploitation requires user interaction and is limited to the context of the current user; no public exploit identified at time of analysis. The CVSS score is 7.8, and the vulnerability is not known to be actively exploited.
Unauthenticated remote code execution affects Adobe Experience Manager as a Cloud Service (0 through 2026.9.28187), AEM 6.5 LTS (through SP3), and AEM 6.5 (through 6.5.25) due to an incorrect authorization check (CWE-863) in a network-reachable component. Because the CVSS vector is PR:N/UI:N, attackers need no credentials and no victim interaction - any internet-facing or otherwise reachable affected instance is directly attackable - and the changed scope (S:C) means a successful exploit can compromise resources beyond the vulnerable component itself, including the victim's account or session and the underlying runtime. At the time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, but the maximum 10.0 base score, the authentication-bypass/RCE tagging from the vendor, and the trivial attack preconditions make this a top-priority remediation item despite the absence of observed exploitation.
Privilege escalation in Adobe Experience Manager (AEM) allows an authenticated, low-privileged user - an author or contributor-level account - to abuse an Improper Restriction of XML External Entity Reference (XXE, CWE-611) in XML parsing and thereby read local files and reach internal resources well beyond their intended permissions, crossing a security boundary as reflected by the scope-changed CVSS 9.6 rating. The vector is network-reachable with no user interaction required (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), so the only real precondition is obtaining valid low-tier credentials, which makes author instances and deployments with broadly provisioned low-privilege accounts the highest-risk exposure. No public exploit code has been identified at time of analysis, and builds updated past the affected ranges are not exploitable.
Reflected cross-site scripting in Adobe Experience Manager allows remote attackers to inject malicious scripts into a web page, requiring user interaction (UI:R) and no authentication (PR:N), which could lead to session hijacking or privilege escalation if the victim is an authenticated AEM author or administrator. Affected deployments include AEM 6.5 up to 6.5.25, AEM as a Cloud Service up to 2026.9.28187, and AEM 6.5 LTS up to SP3. The vendor assigned a CVSS of 9.3, but our independent assessment scores it lower (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) because confidentiality and integrity impacts are limited; no public exploit has been identified at time of analysis.
Incorrect authorization in Adobe Experience Manager 6.5 (up to and including 6.5.25) and AEM 6.5 LTS (up to and including 6.5 LTS SP3) lets an authenticated attacker who holds only a low-privileged account break out of their assigned permission level and execute arbitrary code as the current user, with a changed scope that can extend the compromise to the victim's account or session. The flaw is remotely reachable, requires no user interaction, and carries a 9.9 CVSS base score (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), which our independent assessment confirms is a genuine high-priority issue rather than a CVSS-inflated one. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, although the low-privilege prerequisite means any exposed AEM instance that permits self-registration or has a large internal user base is a realistic target.
Unauthenticated remote code execution in Adobe Experience Manager stems from an incorrect authorization check that lets a remote attacker bypass access controls and execute arbitrary code in the context of the current user, with the changed-scope rating indicating impact can extend beyond the vulnerable component (CVSS 3.1 base 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Every unpatched deployment is in scope: AEM 6.5 up to and including 6.5.25, AEM 6.5 LTS up to and including 6.5 LTS SP3, and AEM as a Cloud Service up to and including 2026.9.28187; no credentials or user interaction are required, and the only practical precondition is that the affected author, publish, or endpoint is reachable from the attacker's network. No public exploit code exists and no confirmed active exploitation (CISA KEV) has been recorded at time of analysis, but the authentication-bypass-to-RCE chain plus the maximum severity score make internet-facing, unpatched instances a top remediation priority rather than a high-score/low-real-risk case.
Unauthenticated remote code execution affects Adobe Experience Manager, specifically AEM as a Cloud Service builds up to and including 2026.9.28187, AEM 6.5 LTS up to and including SP3, and AEM 6.5 up to and including 6.5.25, and is rooted in an incorrect authorization check (CWE-863) that carries a maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Because the defective access-control decision itself is the entry point, a remote attacker needs only network reachability, no credentials, and no user interaction, and the changed scope (S:C) means the resulting arbitrary code execution in the current user's context can be leveraged to gain elevated access or control over a victim's account or session beyond the vulnerable component. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the unauthenticated, no-interaction exploitation profile places internet-exposed AEM instances at top-priority risk, with network isolation (VPN, WAF, non-exposed tiers) and the affected-version boundaries as the main mitigating factors.
Blind XPath/XML injection in Adobe Experience Manager 6.5 (versions 6.5.0 through 6.5.25) allows a low-privileged, authenticated attacker to bypass security controls and read content they should not be able to access, with limited unauthorized write capability. The flaw is network-reachable, requires no user interaction, and carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), reflecting high confidentiality impact but only low integrity impact and no availability impact; the CVSS vector confirms the attacker must hold a valid low-privileged account (PR:L), so unauthenticated outsiders cannot exploit it directly. No public exploit code or confirmed active exploitation was identified at time of analysis, and Adobe has published a vendor security bulletin (apsb26-152) covering the issue.
SQL injection in Adobe Experience Manager 6.5 (through 6.5.25) allows an authenticated, low-privileged attacker to bypass security controls and gain unauthorized read and limited write access to backend data. The flaw is due to improper neutralization of special elements used in SQL commands (CWE-89), and exploitation requires no user interaction. No public exploit code or active exploitation has been identified, and the need for valid low-privilege credentials and the limited version range make this a moderate-priority issue rather than an emergency.
Arbitrary file-system write in Adobe Experience Manager 6.5 (through 6.5.25) and AEM 6.5 LTS (through LTS SP3) allows an authenticated low-privileged attacker to place files in unauthorized locations on the host by sending a crafted request that manipulates a pathname and escapes the intended directory. No user interaction is required and attack complexity is low, but the attacker must already hold a valid low-privilege AEM account and be able to reach the instance over the network; the assessed vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) shows a scope change with high integrity impact and no direct confidentiality or availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a credentialed post-authentication persistence and integrity risk rather than an opportunistic internet-wide exploit, though it is a credible escalation step for anyone who already has a foothold in AEM.
Stored cross-site scripting in Adobe Experience Manager allows attackers to inject malicious scripts into vulnerable form fields, which execute in a victim's browser when they visit the poisoned page, potentially leading to session hijacking or elevated access. Affected versions include AEM 6.5 LTS up to SP3 and AEM 6.5 up to 6.5.25. The vendor CVSS score is 9.3 (PR:N), but independent assessment indicates the injection step may require access to a form-authoring or submission surface (PR:L) and victim interaction is mandatory; no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5 LTS (through SP3) and AEM 6.5 (through 6.5.25) lets an attacker persist a malicious JavaScript payload into a vulnerable form field, which then executes in the browser of any user who views the page rendering that field, yielding high confidentiality and integrity impact with a scope change into the victim's session. Adobe rates this Critical at CVSS 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), while independent assessment scores it lower on the privilege axis at PR:L, reflecting the practical requirement that the attacker be able to submit or store content before triggering execution; all versions converge on UI:R, since the payload remains dormant until a victim browses the affected page. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though the high CVSS score and the authoring-console reachability of AEM make prompt patching per Adobe advisory APSB26-152 advisable.
Arbitrary code execution in Adobe Experience Manager (AEM) allows an attacker with a high-privilege account (e.g., administrator or author-level) to run malicious code on the server, potentially affecting resources beyond the vulnerable component due to changed scope. The improper input validation flaw (CWE-20) affects AEM as a Cloud Service ≤2026.9.28187, AEM 6.5 ≤6.5.25, and AEM 6.5 LTS ≤6.5 LTS SP3, and requires network access but no user interaction. No public exploit or active exploitation has been identified at time of analysis; patches are available per the Adobe advisory (apsb26-152).
Improper input validation in Adobe Experience Manager 6.5 (versions up to and including 6.5.25) allows an attacker who already holds a valid low-privilege account or session to execute arbitrary code in the context of the current user, and because the flaw crosses a security scope boundary it can lead to elevated access or takeover of the victim's account or session. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 9.9) confirms the issue is remotely reachable with low attack complexity and no user interaction, but it explicitly requires an authenticated low-privilege position - it is not exploitable by a fully unauthenticated attacker. No public exploit code has been identified at time of analysis and the vulnerability has not been confirmed as actively exploited (no CISA KEV listing); Adobe has published advisory APSB26-152 covering the fix.
OS command injection in Adobe Experience Manager 6.5 (through 6.5.25) and AEM 6.5 LTS (through SP3) allows an authenticated, low-privileged attacker to run arbitrary operating-system commands in the context of the current user, with changed scope (S:C) meaning the injected command executes outside the application's own security authority on the host. Rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), the exploitation bar is low attack complexity with no user interaction; the only meaningful constraint is the need for a valid low-privilege AEM session, which is a very low bar in multi-user AEM author environments where content authors and other non-admin accounts are routinely issued. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); no EPSS score was supplied with the source data. This is a genuine high-priority vulnerability rather than a CVSS-inflated paper risk, and the specific vulnerable feature or injectable parameter is not named in the advisory summary, so patch validation and hunting should be prioritized on affected instances.
Arbitrary code execution in Adobe Dimension 4.1.8 and earlier occurs through a CWE-426 untrusted search path flaw where a local attacker can pre-stage a malicious DLL or shared library in a directory the application searches ahead of the trusted location, which is then loaded when a victim launches Dimension. Exploitation requires local file-write access and user interaction, and no public exploit or CISA KEV listing has been identified at time of analysis. The vendor CVSS base score is 8.6 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), indicating high impact despite the local and interaction prerequisites.
Arbitrary code execution in Adobe Dimension 4.1.8 and earlier is possible when a user opens a crafted project or asset file containing improperly neutralized input that is then processed during the application's page/content generation (CWE-79). The attack surface is local only: an attacker must first place malicious content on the victim's machine and persuade them to launch Dimension, but success yields full confidentiality, integrity, and availability impact with a changed scope, meaning the resulting code execution can affect resources beyond Dimension's own boundary. The issue is scored CVSS 3.1 base 8.6 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and no public exploit code or confirmed active exploitation has been identified at time of analysis.
An out-of-bounds write (CWE-787) in Adobe Dimension 4.1.8 and earlier allows arbitrary code execution at the privilege level of the user who opens a specially crafted file, such as a malicious Dimension project or imported 3D asset. Exploitation is local and depends entirely on victim interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) - the attacker must deliver a file the user then opens, so this is not a remotely triggerable, wormable flaw; no public exploit code identified at time of analysis and the CVE is not in CISA KEV. The practical risk is genuine but operationally constrained by the mandatory user action, the local delivery requirement, and the shrinking installed base of what our assessment describes as a discontinued product.
An out-of-bounds read (CWE-125) in Adobe Substance 3D Stager 3.1.8 and earlier can lead to arbitrary code execution in the context of the current user when a victim opens a crafted file with the application. Exploitation is local in vector terms (AV:L) and requires user interaction (UI:R), so an attacker must first deliver a malicious asset and persuade the target to open it; code execution is confined to the victim's privileges because the scope is unchanged (S:U). Rated CVSS 7.8 (High), with no public exploit identified at time of analysis and no CISA KEV listing, making this a genuine but not top-tier priority that should be handled through routine patch cycles rather than emergency response.
Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier allows arbitrary code execution in the context of the current user when the victim opens a maliciously crafted 3D project or asset file. The attack path is local and requires user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8), with no network-facing trigger and no privilege escalation beyond the rights of the user who opens the file. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; this is a genuine but not emergency-grade priority, where the practical risk is driven by social engineering that convinces a Stager user to open attacker-supplied content.
An out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier lets an attacker achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted 3D project or asset file. The attack is local in nature (AV:L) and depends entirely on user interaction (UI:R) - the victim must be socially engineered into opening the malicious file - and the resulting code runs with the victim's own privileges rather than elevated rights (no privileges are required per PR:N). At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV, so this is assessed as a moderate-priority, not emergency, memory-corruption flaw whose primary risk is targeted, file-based social engineering against individual Substance 3D Stager workstations.
An out-of-bounds write (CWE-787) in Adobe FrameMaker allows an attacker to corrupt memory and potentially execute arbitrary code with the privileges of the user who opens a maliciously crafted document. Affected builds are FrameMaker 2026 at or below 18.0.0.206 and FrameMaker 2022 at or below 17.0.9.866. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) confirms there is no network or unauthenticated trigger: exploitation depends on social engineering a victim into opening a booby-trapped file, and any code that runs is confined to the current user's rights with no privilege escalation. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, making this a credible but not emergency-tier patching priority.
Arbitrary code execution in Adobe FrameMaker is possible via a heap-based buffer overflow (CWE-122) that is triggered when the victim opens a specially crafted file. The CVSS:3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (score 7.8) indicates the flaw is local to the desktop application, requires user interaction, needs no prior authentication, and gives the attacker only the privileges of the user who opens the document. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation; the main risk is social engineering against FrameMaker users.
Arbitrary code execution in Adobe FrameMaker is possible when a user opens a maliciously crafted file, due to a use-after-free (CWE-416) memory corruption flaw. The vulnerability requires user interaction (UI:R) and is local (AV:L), meaning an attacker must deliver the file to the victim, who then opens it; no authentication is needed (PR:N). While no public exploit code has been identified, the issue is rated CVSS 7.8 and is considered a genuine but not emergency-grade priority; Adobe has published a security bulletin (APSB26-172) with remediation guidance.