Adobe
Monthly
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of the logged-in user when a victim opens a specially crafted file. Tagged as Memory Corruption, RCE, and Buffer Overflow by Adobe PSIRT, the vulnerability carries a CVSS 7.8 (High) rating. No public exploit or CISA KEV listing has been identified at time of analysis, but the file-based attack vector makes it suitable for phishing and malicious download campaigns targeting creative professionals.
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of the logged-in user when a crafted malicious file is opened. The vulnerability is rooted in improper memory boundary validation during file parsing (CWE-787), yielding full confidentiality, integrity, and availability impact per CVSS. No public exploit or CISA KEV listing has been identified at time of analysis, but the RCE-class severity and file-delivery vector make this a meaningful phishing or watering-hole risk for creative professionals.
Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 allows arbitrary code execution in the context of the logged-in user when a specially crafted file is opened. Adobe's PSIRT reported the issue under advisory APSB26-94, and the ENISA EUVD tracks it as EUVD-2026-56829. No public exploit or CISA KEV listing has been identified at time of analysis, though the CWE-787 memory corruption class combined with a confirmed high C/I/A impact triad warrants prompt patching across all affected release branches.
Unsafe deserialization of untrusted data in Adobe Lightroom Classic (versions ≤15.4.1) enables arbitrary code execution in the context of the authenticated user when a victim opens a specially crafted file. Classified as CWE-502, this file-format exploit carries a CVSS 3.1 score of 8.6 with changed scope (S:C), indicating impact extends beyond the Lightroom process itself to broader user-accessible system resources. No public exploit identified at time of analysis and no CISA KEV listing; Adobe has released a fix in version 15.5 via security bulletin APSB26-94.
SQL injection in Adobe Campaign Classic (ACC) v7 through 7.4.3 build 9399 allows a remote attacker to inject crafted SQL and achieve arbitrary code execution in the context of the current user, per Adobe advisory APSB26-123. The flaw is rated CVSS 9.0 (critical) with a scope change, but Adobe notes exploitation depends on conditions beyond the attacker's control (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is achievable by tricking a victim into opening a specially crafted malicious file, exploiting an integer overflow in the application's file parsing logic (CWE-190). The flaw yields full compromise of confidentiality, integrity, and availability within the current user's context, consistent with the CVSS 7.8 score. Adobe has released a patch in version 15.5 per advisory APSB26-94; no public exploit has been identified at time of analysis.
Arbitrary code execution in Adobe Campaign Classic (ACC) v7 through 7.4.3 build 9399 lets a remote, unauthenticated attacker run code in the context of the current user via an incorrect-authorization flaw (CWE-863). The maximum CVSS 3.1 base score of 10.0 reflects a network-reachable, no-interaction bug with a changed scope, meaning impact can extend beyond the initially vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated RCE and a vendor PSIRT advisory makes this a top-priority patch.
Path traversal in Adobe's Content Credentials toolkit - spanning the c2patool CLI, the c2pa Rust SDK, and the @contentauth/c2pa-web JavaScript/WASM SDK - enables arbitrary file-system reads outside intended directory boundaries on the local host. Affected versions include c2patool ≤ v0.27.5, c2pa-rs ≤ v0.90.5, and @contentauth/c2pa-web ≤ 0.12.0, with patched releases available for all three. No public exploit has been identified at time of analysis, but the scope-changed flag in the CVSS vector indicates that successful exploitation can reach resources beyond the vulnerable component's own security domain.
Uncontrolled resource consumption in Adobe's CAI Content Credentials SDK enables remote unauthenticated attackers to exhaust system resources and cause an application denial-of-service. Three distinct SDK components are affected: the Rust SDK (c2pa), the JavaScript/WebAssembly SDK (@contentauth/c2pa-web), and the command-line tool (c2patool), all across their respective versions prior to the patched releases. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is trivially exploitable without authentication or user interaction.
Null pointer dereference in Adobe's Content Credentials SDKs (Rust SDK ≤c2pa-v0.90.5, JS SDK ≤@contentauth/c2pa-web@0.12.1, CLI tool ≤c2patool-v0.27.5) enables unauthenticated remote attackers to crash any application built on these libraries by supplying a crafted C2PA media payload. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms straightforward remote exploitation with zero prerequisites or user involvement. No active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis; vendor-released patches are available for all three SDK components.
Incorrect Authorization (CWE-863) in Adobe ColdFusion 2023 and 2025 allows adjacent-network attackers to bypass authorization controls and execute arbitrary code in the context of the ColdFusion service account. The vulnerable administrative component is confined to an administrative network zone by default, limiting internet-scale exposure but leaving internal networks and misconfigured deployments at significant risk. No public exploit code or CISA KEV listing has been identified at time of analysis, though the complete CIA impact and zero-authentication requirement make this a high-priority patch target for any organization running ColdFusion.
OS command injection in Adobe ColdFusion 2023 and 2025 allows a low-privileged, network-authenticated attacker to bypass security controls and gain unauthorized write access to resources outside the application's normal permission boundary. The CVSS scope-change metric (S:C) confirms impact extends beyond the vulnerable component itself, meaning successful exploitation can affect the underlying operating system or adjacent system resources. No public exploit has been identified at time of analysis, but the low attack complexity and low privilege requirement make this a credible risk for any internet-exposed or internally accessible ColdFusion deployment.
Incorrect Authorization in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to bypass security controls and gain limited unauthorized read and write access to protected resources, with a limited disruption to availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication, no user interaction, and is reachable over the network under low complexity conditions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Improper Input Validation in Adobe ColdFusion 2023 and 2025 allows unauthenticated remote attackers to bypass security controls, gaining unauthorized read and limited write access to affected systems. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is a low-complexity, network-exploitable flaw requiring no privileges or user interaction, elevating real-world risk for any internet-facing ColdFusion deployment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but ColdFusion's history as a high-value target warrants prompt patching.
Heap-based buffer overflow in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to execute arbitrary code in the context of the ColdFusion server process. The vulnerability requires high-complexity exploitation conditions outside the attacker's direct control, yielding a CVSS score of 8.1 rather than critical, but the triple-high impact (full confidentiality, integrity, and availability compromise) makes it a high-priority target. No public exploit code or CISA KEV listing has been identified at time of analysis, though ColdFusion's historical targeting by ransomware and state-sponsored actors elevates real-world urgency beyond what the AC:H qualifier alone would suggest.
Hard-coded cryptographic key in Adobe ColdFusion 2023 and 2025 enables a local low-privileged attacker to bypass security controls and gain unauthorized read and write access with scope change to components beyond the vulnerable server. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H) confirms local access with minimal complexity is sufficient - no user interaction is needed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the deterministic, non-rotating nature of a hard-coded key means any attacker who extracts it retains persistent capability until the key is replaced via patch.
Sensitive memory disclosure in Adobe ColdFusion 2023 and 2025 stems from the server's use of a broken or risky cryptographic algorithm (CWE-327), enabling a remote unauthenticated attacker to retrieve confidential data - such as session tokens, credentials, or application secrets - that transit or reside in vulnerable cryptographic operations. Both the 2023 and 2025 product lines are confirmed affected per Adobe's own CPE data. No user interaction is required, and the CVSS vector confirms full network exploitability against default deployments. No public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in Adobe ColdFusion 2023 and 2025 enables remote, unauthenticated attackers to execute arbitrary operating-system commands in the context of the ColdFusion service account. Rated CVSS 10.0 with a scope change (S:C), this flaw stems from improper neutralization of special elements passed into an OS command and requires no user interaction. No public exploit identified at time of analysis, but ColdFusion's history as an attacker-favored target makes rapid patching essential.
Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrative user when a victim opens a crafted malicious file. The vulnerable component is restricted to the administrative network zone by default (AV:A), limiting exposure to internal or VPN-connected segments, but the scope change (S:C) with full CIA impact confirms that successful exploitation can cascade beyond the immediate ColdFusion application context. No public exploit has been identified at time of analysis; however, Adobe's advisory APSB26-90 confirms the RCE potential and the high severity rating of 8.8.
Security feature bypass in Adobe ColdFusion 2023 and 2025 lets attackers with adjacent network access defeat authorization checks (CWE-863, Incorrect Authorization) and obtain unauthorized read and write access, potentially forcing an application denial-of-service. The flaw carries a CVSS 9.6 (scope-changed) rating and requires no user interaction, though the vulnerable component sits inside an administrative network zone by default. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so treat the 9.6 as high potential rather than confirmed active abuse.
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and write access through an Incorrect Authorization flaw (CWE-863). Exploitation requires only a low-privileged local account and no user interaction, yielding full confidentiality, integrity, and availability impact on the affected system. Adobe has published advisory APSB26-90; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged authenticated attacker to gain unauthorized read and write access beyond their authorized security scope by exploiting improper input validation in file processing. The attack requires social engineering - a victim with higher privileges must open a specially crafted malicious file - after which the attacker's effective permissions cross security boundaries (scope change, S:C) to reach resources outside the original ColdFusion component. No public exploit or CISA KEV listing has been identified at time of analysis, though the high CVSS score of 8.7 and scope-change impact warrant prompt remediation per Adobe advisory APSB26-90.
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where improperly neutralized special elements in the template engine let an attacker run arbitrary code in the context of the current user. Any exposed ACC instance is affected, and per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote, low-complexity, and requires no privileges or user interaction, with a changed scope pushing the CVSS base score to a maximum 10.0. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the perfect score and SSTI class make it a high-priority patch target.
Privilege escalation in Adobe Campaign Classic (ACC) stems from an incorrect authorization flaw (CWE-863) that lets an attacker gain elevated privileges without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores it 9.8 Critical, implying a network-reachable, low-complexity path to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is currently theoretical based on the vendor advisory.
Remote code execution in Adobe Campaign Classic (ACC) lets an authenticated low-privileged attacker inject directives into dynamically evaluated code (CWE-95 eval injection) and run arbitrary code in the context of the current user. Because the CVSS scope is changed, the impact can reach components beyond the initially exploited one, driving the 9.6 critical score. Reported by Adobe with advisory APSB26-120; no public exploit identified at time of analysis and no CISA KEV listing.
Server-Side Request Forgery in Adobe Campaign Classic (ACC) enables remote attackers to coerce the server into issuing crafted internal requests, resulting in privilege escalation without any user interaction. Adobe rates the flaw at the maximum CVSS 10.0 with a changed scope, indicating the SSRF pivots beyond the vulnerable component to compromise other systems or trust boundaries. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, network-reachable nature makes it a top-priority patch.
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that escalate to arbitrary code execution in the context of the current user, per Adobe advisory APSB26-120. The CVSS 3.1 base score is a maximum 10.0 with a changed scope, reflecting network reachability, no privileges, no user interaction, and full confidentiality/integrity/availability impact spilling into adjacent components. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximum severity and unauthenticated network vector make this a top-priority patch.
Security feature bypass in Adobe Campaign Classic (ACC) exposes sensitive data to unauthenticated remote attackers via a violation of secure design principles (CWE-657). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms that exploitation requires no credentials, no user interaction, and low attack complexity against any network-accessible ACC instance, yielding high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis; Adobe has published advisory APSB26-120 addressing this issue.
SQL injection in Adobe Campaign Classic (ACC) allows a low-privileged, authenticated attacker to execute arbitrary code in the context of the current user without any user interaction. Because unsanitized input reaches an SQL command (CWE-89), an attacker with minimal access can pivot from database manipulation to code execution, and the CVSS scope change (S:C) indicates the impact extends beyond the vulnerable component itself. No public exploit identified at time of analysis, but the 9.9 base score and Adobe's own advisory (APSB26-120) mark this as a top-priority enterprise marketing-platform flaw.
Arbitrary code execution in Adobe Premiere Pro stems from an out-of-bounds write (CWE-787) triggered when processing a specially crafted media or project file, running code in the context of the logged-in user. The attack is file-based and local, requiring an adversary to socially engineer a victim - a realistic threat vector for creative professionals who routinely receive media files from external sources. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, but the high CVSS impact metrics (C:H/I:H/A:H) indicate full user-level compromise upon successful exploitation.
Arbitrary code execution in Adobe Campaign Classic (ACC) versions 7.4.3 build 9397 and earlier stems from an incorrect authorization flaw (CWE-863) that lets remote attackers run code in the context of the current user without any user interaction. Adobe's PSIRT reported the issue and rates it CVSS 9.8; it is tagged as an authentication-bypass-to-RCE chain. There is no public exploit identified at time of analysis, and it is not on CISA KEV, but SSVC flags the technical impact as total and the attack as automatable.
Sensitive data disclosure in Adobe Campaign Classic (ACC) allows a remote, unauthenticated attacker to read arbitrary files from the underlying host by exploiting an SQL injection flaw (CWE-89) that reaches file-system read primitives. Because the CVSS scope is changed and no user interaction is required, a single crafted request against an exposed ACC instance can leak sensitive memory and file contents (CVSS 8.6). There is no public exploit identified at time of analysis, but the network vector and low attack complexity make this a high-priority patch.
Out-of-bounds write in Adobe Bridge allows arbitrary code execution when a user opens a malicious file. The vulnerability requires user interaction and runs code in the context of the current user. No active exploitation or public exploit code is known at the time of analysis.
We need to parse the input data and produce a JSON object with the specified fields. The description: "Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed." CVSS 3.1 vector: AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, score 8.2. CWE-426: Untrusted Search Path. Tags: RCE, Adobe Bridge. SSVC: exploitation none, automatable no, technical impact total. Patch: there is no explicit patch data in the input, but references point to Adobe advisory: https://helpx.adobe.com/security/products/bridge/apsb26-89.html. The version ranges affected: "Adobe Bridge 0 ≤16.0.5" and "Adobe Bridge 0 ≤15.1.6" (probably meaning versions up to but not including? The EUVD says "Adobe Bridge 0 ≤16.0.5" and "0 ≤15.1.6" which is ambiguous — likely affected versions up to, but not including? Actually, it says "0 ≤16.0.5" which might indicate versions from 0 up to 16.0.5, so 16.0.5 is affected. But typical phrasing "versions up to and including 16.0.5". The advisory APSB26-89 might have more details. We'll note that affected products are Adobe Bridge versions up to 16.0.5 and 15.1.6, and presumably patch versions are later: 16.0.6 and 15.1.7? But the advisory isn't fully spelled out in input. We'll extract from the EUVD data: "Adobe Bridge 0 \u226416.0.5" means "Adobe Bridge 0 ≤16.0.5". So version 16.0.5 and earlier are affected. The referenced advisory likely states patched version 16.0.6. So remediation: update to version 16.0.6 (or 15.1.7 for 15.x branch). We'll incorporate that. We have no KEV status, so no active exploitation confirmed. No POC mentioned, but no explicit statement, so we'll say no public exploit identified. SSVC exploitation none, automatable no, so not easily automated. EPSS not provided, bu
Path traversal in Adobe Bridge allows local attackers to read arbitrary files from the victim's file system when a crafted malicious file is opened. Affected versions include all releases up to 15.1.6 and 16.0.5. No active exploitation or public PoC has been identified at this time, and the vendor has issued a fix via APSB26-89.
Arbitrary code execution in Adobe Bridge allows local attackers to execute arbitrary code in the victim's context by enticing a user to open a malicious file. The out-of-bounds write vulnerability (CWE-787) requires no authentication and has not been reported as actively exploited or in the CISA Known Exploited Vulnerabilities catalog. No public exploit code is known at this time.
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim. Affected versions up to 15.1.6 and 16.0.5 are susceptible. Exploitation requires user interaction; a scope change can impact other system components, though no public exploit or active exploitation has been identified at time of analysis.
Arbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerability. A local attacker can craft a malicious file that, when opened by a victim, causes Bridge to load and execute a malicious DLL from an attacker-controlled location, leading to full system compromise in the context of the current user. No active exploitation or public exploit code is known at time of analysis, and EPSS data is not available.
Opening a malicious file in Adobe Bridge triggers an out-of-bounds write, leading to arbitrary code execution with the current user's privileges. Adobe has released a security update to address this issue via bulletin APSB26-89. No active exploitation or public exploit has been identified at the time of analysis.
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows an attacker to bypass security constraints and run code with the current user's privileges. No active exploitation or public proof-of-concept has been reported, but the vulnerability carries a high CVSS score due to scope change and full system impact.
Opening a malicious file in Adobe Format Plugins can trigger a heap-based buffer overflow, allowing arbitrary code execution in the context of the current user. Exploitation requires user interaction, and no active exploitation or public exploit code has been reported at this time.
We need to produce a JSON object with multiple fields. Let's analyze the input. CVE ID: CVE-2026-48388 Description: Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the installer. Exploitation of this issue required user interaction in that a victim must have been running the installer. Scope is changed. CVSS Score: 8.6 CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CWE: CWE-427 Multi-source: Reported by Adobe. CPE: cpe:2.3:a:adobe:adobe_photoshop_installer:*:*:*:*:*:*:*:* (all versions?). Tags: Adobe, RCE, Adobe Photoshop Installer. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. ENISA EUVD ID. Affected versions from EUVD: ["Adobe Photoshop Installer 0 ≤N/A"] - weird, maybe that's not precise. References: cveorg link (None?) and euvd advisory NVD link. Now, we must fill out all fields. No arrays, no nested JSON, plain text strings. product_name: 1-3 words ONLY. Affected product is "Adobe Photoshop Installer". So "Adobe Photoshop Installer". That's 3 words. Could also be just "Photoshop Installer" but better to include "Adobe". I'll output "Adobe Photoshop Installer". summary: 2-3 sentence plain-language synthesis. Not copying description. Should start with specific impact and product, e.g., "Arbitrary code execution in Adobe Photoshop Installer allows..." but careful: it's the installer, not Photoshop itself. The vulnerability is uncontrolled search path element (DLL hijacking). The attacker places a malicious library in a directory searched by the installer, and when the victim runs the installer, arbitrary code executes in the current user context. User interaction required. Use all data: SSVC says not exploited (none), not automatable, total impact. EPSS? None provided. KEV? Not mentioned.
Arbitrary code execution in Adobe DNG SDK version 1.7.1 (build 2536) and earlier arises from a stack-based buffer overflow triggered when parsing a maliciously crafted image file, allowing an attacker to run code in the context of the current user. Applications that embed the DNG SDK to decode Digital Negative (DNG) raw camera files are affected, and successful exploitation requires the victim to open the malicious file. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Arbitrary code execution in Adobe Acrobat Reader arises from a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted file, allowing an attacker to run code in the context of the current user. All affected versions covered by Adobe advisory APSB26-63 are impacted, and successful exploitation grants full high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, so risk is currently latent rather than active.
Denial-of-service in Adobe's C2PA / Content Credentials SDKs allows a remote attacker to crash any application built on the c2pa Rust SDK (≤0.84.0), the c2patool command-line utility (≤0.16.5), or the @contentauth/c2pa-web JavaScript SDK (≤0.7.0) by supplying malformed input that the library fails to validate. Because exploitation requires no authentication and no user interaction, an application that ingests attacker-controlled assets or manifests can be reliably knocked offline. There is no public exploit identified at time of analysis, and the low EPSS (0.41%) with CISA SSVC exploitation status of 'none' indicates no observed activity yet, though the flaw is assessed as automatable.
Denial-of-service in Adobe's Content Credentials (C2PA) SDK ecosystem lets a remote attacker crash any application that ingests attacker-supplied C2PA-signed assets. The flaw stems from improper input validation (CWE-20) in the Rust c2pa SDK, the @contentauth/c2pa-web JS SDK, and the c2patool command-line utility; exploitation requires no user interaction and no authentication (CVSS 7.5, A:H). No public exploit code has been identified and it is not in CISA KEV, though CISA's SSVC framework flags it as automatable, meaning a working exploit could be scaled easily.
Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) allows an attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw is an out-of-bounds write (CWE-787) triggered during file parsing and requires user interaction, so it is not remotely exploitable without victim action. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low (0.14%, 4th percentile), indicating no evidence of active exploitation.
Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) stems from an out-of-bounds write when parsing a maliciously crafted file, letting an attacker run code in the context of the current user. Exploitation requires the victim to open a booby-trapped file, so it is a file-format/client-side attack rather than a remotely reachable service flaw. No public exploit has been identified at time of analysis (SSVC exploitation: none), and EPSS is low at 0.14% (4th percentile).
Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) allows a remote attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw is an out-of-bounds write (CWE-787) with total technical impact per CISA SSVC, but no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile). Exploitation hinges on user interaction, so it is a file-delivery/social-engineering vector rather than a remotely automatable one.
Arbitrary code execution in Adobe Illustrator 2025 (≤29.8.7) and 2026 (≤30.5) allows an attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw stems from improper input validation (CWE-20) during file parsing and carries a scope-changed CVSS of 9.3, but there is no public exploit identified at time of analysis and EPSS is low at 0.39% (31st percentile). CISA SSVC rates exploitation as none with total technical impact, indicating high potential damage but no observed weaponization.
Credential disclosure in Adobe's CAI Content Credentials (C2PA) tooling - spanning the Rust SDK (c2pa ≤0.84.0), the JS SDK (@contentauth/c2pa-web ≤0.7.0), and the c2patool command-line utility (≤0.16.5) - allows a remote attacker to gain unauthorized read access to sensitive credentials due to insufficient protection of stored secrets (CWE-522). The CVSS 3.1 vector (AV:N/PR:N/UI:N, C:H) rates it 7.5 High with no authentication or user interaction required. There is no public exploit identified at time of analysis, CISA SSVC lists exploitation as none, and EPSS is low at 0.39% (31st percentile), so no active exploitation is evidenced.
Server-Side Request Forgery in Adobe's C2PA (Content Credentials) SDK family - the Rust SDK (c2pa), the Node.js web SDK (c2pa-web), and the c2patool CLI - can escalate to arbitrary code execution in the context of the current user. When an application built on these libraries validates a maliciously crafted asset or URL, the SSRF is chained into script injection to hijack the victim's session or account. No public exploit has been identified at time of analysis, and the EPSS score is low (0.18%, 7th percentile), consistent with CISA SSVC rating exploitation as 'none'.
Arbitrary code execution in Adobe's Content Authenticity (CAI) Content Credentials tooling — the c2pa Rust SDK (≤0.84.0), the @contentauth/c2pa-web JS SDK (≤0.7.0), and the c2patool CLI (≤0.16.5) — arises from an untrusted search path (CWE-426) that loads attacker-controlled libraries and runs code as the current user. Adobe PSIRT reports the flaw requires victim interaction (visiting a crafted URL or interacting with a compromised page) and a local attack vector, and there is no public exploit identified at time of analysis. EPSS is low (0.14%, 4th percentile) and CISA SSVC records exploitation as 'none', consistent with a not-yet-exploited but total-technical-impact issue.
Arbitrary code execution in Adobe Illustrator Desktop (2026 versions ≤30.5 and 2025 versions ≤29.8.7) allows an attacker to run code in the context of the current user when a victim opens a maliciously crafted file that abuses an untrusted search path (CWE-426). The flaw carries a CVSS 3.1 score of 8.6 with a changed scope, but exploitation is local and requires user interaction. There is no public exploit identified at time of analysis, EPSS is low (0.16%, 5th percentile), and CISA SSVC rates exploitation as none.
Server-side request forgery in Adobe ColdFusion lets a low-privileged, authenticated attacker coerce the server into issuing crafted outbound requests, bypassing a security control and gaining unauthorized read access to resources the attacker should not reach. The CVSS 3.1 scope-changed vector (S:C, C:H) indicates the impact extends beyond ColdFusion itself to backend or internal systems it can reach. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; remediation is available via Adobe security bulletin APSB26-82.
Security feature bypass in Adobe ColdFusion allows a low-privileged, network-based attacker to defeat access controls and obtain unauthorized read access to data outside their intended authorization boundary. Adobe PSIRT classifies the root cause as improper input validation and tags it an authentication bypass; the CVSS 3.1 score is 7.7 with a changed scope, reflecting impact that crosses a security boundary. No public exploit has been identified at time of analysis, and no EPSS or CISA KEV data was provided.
Arbitrary code execution in Adobe ColdFusion allows an attacker with low-privileged access on an adjacent network to bypass authorization controls (CWE-863) and run code in the context of the current user, with a scope change that lets the impact extend beyond the vulnerable component. Adobe PSIRT reported the flaw and published advisory APSB26-82; it is tagged as RCE and authentication bypass with a CVSS 3.1 base score of 9.0. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the incorrect-authorization-to-RCE pattern in ColdFusion has historically drawn rapid attacker interest.
Missing authentication in Adobe ColdFusion allows an unauthenticated attacker on an adjacent network to trigger arbitrary code execution in the context of the current user, without any user interaction. The flaw (CWE-306) bypasses authentication on a critical function and carries a scope change, meaning the impact reaches beyond the vulnerable component. There is no public exploit identified at time of analysis, but the issue was reported by Adobe PSIRT and addressed in advisory APSB26-82.
SQL injection in Adobe ColdFusion 2023 and 2025 lets an attacker with high privileges inject crafted SQL that escalates to arbitrary code execution in the context of the current user, with a changed scope that extends impact beyond the vulnerable component. The flaw (CWE-89, CVSS 9.1) affects ColdFusion 2023 through Update 21 and ColdFusion 2025 through Update 10, requires no user interaction, and was disclosed by Adobe PSIRT. There is no public exploit identified at time of analysis, and EPSS is modest at 0.69% (49th percentile).
Code injection (CWE-94) in Adobe ColdFusion 2023 (Update 21 and earlier) and ColdFusion 2025 (Update 10 and earlier) allows a low-privileged, network-adjacent attacker to execute arbitrary code in the context of the current user without any user interaction. Because the CVSS scope is changed, successful exploitation can extend impact beyond the vulnerable component to the underlying host. There is no public exploit identified at time of analysis and the EPSS probability is low (0.43%, 35th percentile), but the near-maximum CVSS of 9.9 and Adobe's own PSIRT reporting make this a high-priority patch.
Privilege escalation in Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) allows an adjacent-network attacker to bypass authorization checks and gain unauthorized read and write access without any user interaction. Because the CVSS scope is changed, a successful exploit can affect resources beyond the vulnerable component. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the CWE-863 root cause and 9.3 base score make it a high-priority patch for internet-adjacent ColdFusion servers.
Reflected Cross-Site Scripting in Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) enables unauthenticated adjacent-network attackers to inject malicious scripts into a victim's browser session, achieving high-severity confidentiality and integrity impact through session hijacking or account takeover. Exploitation requires user interaction - a victim must open a malicious file - and CVSS scope change (S:C) reflects that the impact crosses from the ColdFusion server context into the victim's browser environment. EPSS sits at 3.75% raw probability but at the 89th percentile, indicating elevated relative risk among all CVEs; however, SSVC rates exploitation as 'none' and the vulnerability is not listed in CISA KEV, so no public exploit identified at time of analysis.
Arbitrary code execution in Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) arises from a path traversal weakness that lets an authenticated attacker with high privileges escape a restricted directory and run code in the context of the current user. Because the CVSS scope is changed (S:C), successful exploitation can affect resources beyond the vulnerable component, and CISA's SSVC rates the technical impact as total. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.93%), indicating no evidence of widespread automated exploitation yet.
Path traversal in Adobe ColdFusion allows an authenticated remote attacker (PR:L) to read arbitrary files outside the intended web/application scope by manipulating pathname input, per Adobe advisory APSB26-82. The flaw carries a critical 9.9 CVSS with a changed scope, meaning a successful read can reach files belonging to other security contexts on the host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Arbitrary code execution in Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) allows an unauthenticated attacker on an adjacent network to run code in the context of the current user via improper input validation, with no user interaction required and a scope change extending impact beyond the vulnerable component. Adobe (APSB26-82) rates it CVSS 9.6; there is no public exploit identified at time of analysis and CISA's SSVC framework reports exploitation status 'none'. EPSS estimates a 2.17% 30-day exploitation probability (80th percentile), notable but not extreme for a critical-rated ColdFusion RCE.
Arbitrary code execution in Adobe Bridge allows an attacker to run code in the context of the current user by tricking a victim into opening a maliciously crafted file that triggers an untrusted pointer dereference (CWE-822). The flaw is local and file-based, requiring user interaction; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation yields full impact on confidentiality, integrity, and availability limited to the privileges of the user running Bridge.
Arbitrary code execution in Adobe Bridge is possible through an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, running attacker code in the context of the current user. All versions covered by Adobe advisory APSB26-81 are affected, and while there is no public exploit identified at time of analysis, the local user-interaction attack pattern is consistent with weaponized document/asset lures. The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact once a victim is socially engineered into opening the file.
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap-based buffer overflow (CWE-122), letting an attacker run code in the context of the current user. The flaw was reported by Adobe and disclosed in advisory APSB26-81; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is file-borne and requires user interaction, so it is not remotely triggerable without a user opening attacker-supplied content.
Arbitrary code execution in Adobe Bridge results from an out-of-bounds write (CWE-787) that a victim triggers by opening a malicious file, running attacker-supplied code with the privileges of the current user. The flaw is local (AV:L) and requires user interaction, so it is a client-side, file-borne bug rather than a remotely reachable service vulnerability. No public exploit identified at time of analysis and it is not listed in CISA KEV; Adobe patched it in advisory APSB26-81.
Arbitrary code execution in Adobe Bridge arises from an integer overflow (CWE-190) triggered when a victim opens a maliciously crafted file, allowing an attacker to run code in the context of the current user. The flaw is local and requires user interaction, carrying a CVSS 7.8 (High) score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file, triggering an out-of-bounds write (CWE-787) that executes attacker-controlled code in the context of the current user. The flaw affects Adobe Bridge as reported by Adobe (advisory APSB26-81) and is rated CVSS 7.8; no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is local and hinges entirely on user interaction - the victim must open the malicious file.
Local arbitrary code execution in Adobe Creative Cloud Desktop lets a low-privileged user run code in the context of the current user by exploiting an uncontrolled search path (CWE-427) — the class of flaw where an application loads a library or executable from an attacker-influenced directory. Adobe (CVE-2026-48272) rates it CVSS 7.8, but the vector is local with high attack complexity and requires existing low-level privileges, and exploitation depends on conditions beyond the attacker's control. No public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a defense-in-depth patch rather than an emergency.
Local privilege escalation to arbitrary code execution affects the Adobe Creative Cloud Desktop application through a Time-of-check Time-of-use (TOCTOU) race condition, letting a low-privileged local attacker execute code and - because the CVSS scope is changed - impact resources beyond the initial security context. No user interaction is required, but the race is hard to win: exploitation depends on conditions beyond the attacker's control, reflected in the high attack complexity. At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV.
Arbitrary code execution in Adobe After Effects arises from an out-of-bounds write (CWE-787) that runs in the context of the current user when a victim opens a maliciously crafted project or media file. Adobe (via advisory APSB26-78) confirms the flaw; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 7.8 CVSS reflects high impact tempered by the local vector and required user interaction.
Arbitrary code execution in Adobe After Effects arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted project or media file, running attacker code with the privileges of the current user. Adobe self-reported the flaw in advisory APSB26-78; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 7.8 (High) rating reflects high confidentiality, integrity, and availability impact but is gated by required user interaction and local file delivery.
Arbitrary code execution in Adobe Premiere Pro is possible via a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted project or media file, running attacker code in the context of the current user. The flaw is local and requires user interaction, with no public exploit identified at time of analysis; Adobe self-reported it in advisory APSB26-76. CVSS 7.8 reflects high confidentiality, integrity, and availability impact but a local attack vector gated by the user opening a malicious file.
Arbitrary code execution in Adobe Premiere Pro via an out-of-bounds write (CWE-787) that lets an attacker run code in the context of the current user when a victim opens a maliciously crafted project or media file. The flaw is memory-corruption based and file-driven, requiring user interaction rather than network exposure; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS data was not provided, but the local, user-interaction-gated vector places this in the file-format/client-side attack category typical of Adobe desktop products.
Arbitrary code execution in Adobe Premiere Pro is possible when a victim opens a maliciously crafted project or media file, triggering an out-of-bounds write (CWE-787) that runs attacker code in the context of the current user. The flaw was reported by Adobe (advisory APSB26-76) and carries a CVSS 3.1 base score of 7.8 (local vector, requires user interaction). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently driven by the ease of social-engineering a user into opening a booby-trapped file.
Arbitrary code execution in Adobe Media Encoder arises from a stack-based buffer overflow (CWE-121) triggered when a victim opens a maliciously crafted media file, allowing an attacker to run code in the context of the current user. The CVSS 3.1 base score is 7.8 (local vector, user interaction required, no privileges needed). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is file-delivery-driven rather than remotely wormable.
Arbitrary code execution in Adobe Media Encoder is possible through an out-of-bounds write triggered when a victim opens a maliciously crafted media file, running attacker code in the context of the current user. The flaw was reported by Adobe and is addressed in advisory APSB26-72; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation hinges on user interaction (opening the file) and yields high impact to confidentiality, integrity, and availability.
Arbitrary code execution in Adobe Media Encoder is possible when a victim opens a maliciously crafted media file, triggering an out-of-bounds write (CWE-787) that runs attacker code in the context of the current user. The flaw is local and requires user interaction, so it is not remotely wormable, but successful exploitation grants full compromise of the user's session. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Adobe published advisory APSB26-72 addressing the issue.
Arbitrary code execution in Adobe Media Encoder arises from an out-of-bounds write (CWE-787) that lets a crafted media file corrupt memory and run attacker-controlled code in the context of the current user. Any user who opens a malicious file in the affected desktop application is at risk, with full loss of confidentiality, integrity, and availability on the host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary code execution in Adobe Animate 2023 and 2024 arises from an untrusted search path (CWE-426) flaw that lets a malicious file, when opened by a victim, load attacker-controlled code in the context of the current user. The issue was reported by Adobe (advisory APSB26-83), requires user interaction, and carries a CVSS 3.1 base score of 7.9 with a changed scope. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in Adobe Animate 2023 and 2024 allows an attacker to run commands in the context of the current user via an OS command injection flaw (CWE-78) triggered when a victim opens a maliciously crafted file. The scope-changed CVSS 3.1 score of 8.2 reflects that successful exploitation can affect resources beyond the vulnerable application. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the primary risk gate is social-engineering the victim into opening a hostile document.
Arbitrary code execution in Adobe Animate 2023 and 2024 allows an attacker to run OS commands in the context of the current user when a victim opens a maliciously crafted file. The flaw is an OS command injection (CWE-78) with no public exploit identified at time of analysis and no active exploitation reported in CISA KEV; risk hinges on social-engineering a user into opening the file. Adobe published fixes in advisory APSB26-83.
Arbitrary code execution in Adobe Animate 2023 and 2024 stems from an incorrect authorization (CWE-863) weakness that lets code run in the context of the current user. Adobe reported the flaw via advisory APSB26-83 with a CVSS 8.1 rating; exploitation requires no user interaction but depends on conditions outside the attacker's control (reflected in high attack complexity). There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Arbitrary code execution in Adobe Animate 2023 and 2024 arises from an Incorrect Authorization flaw (CWE-863) that lets a maliciously crafted file run code in the context of the current user. Exploitation requires the victim to open the attacker-supplied file and depends on conditions beyond the attacker's control, and there is no public exploit identified at time of analysis. Adobe self-reported the issue and published fixes in advisory APSB26-83.
Arbitrary code execution in Adobe Animate 2023 and 2024 stems from a path traversal weakness triggered when a victim opens a maliciously crafted file, letting an attacker run code in the context of the current user and reach files or directories outside intended restrictions. The flaw carries a CVSS 3.1 base score of 8.6 with a changed scope, reflecting impact beyond the initially vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation risk hinges on social-engineering a user into opening a rogue project file.
Incorrect Authorization (CWE-863) in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin enables remote unauthenticated attackers to bypass security controls and gain unauthorized read and limited write access to protected resources. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special network position, making it trivially automatable - a finding corroborated by SSVC's Automatable:yes designation. No public exploit or active exploitation has been identified at time of analysis, and EPSS sits at 0.53% (41st percentile), suggesting limited opportunistic exploitation activity despite the high CVSS score.
Incorrect Authorization in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Webhooks Plugin allows unauthenticated remote attackers to bypass security controls and gain unauthorized read and limited write access to protected resources. The full product ecosystem is affected across multiple active release lines, with vendor-confirmed July 2026 patches available via APSB26-73. No active exploitation has been confirmed (CISA KEV absent, SSVC exploitation: none), though the SSVC framework flags the attack as automatable - meaning mass scanning tools could trivially target exposed storefronts.
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of the logged-in user when a victim opens a specially crafted file. Tagged as Memory Corruption, RCE, and Buffer Overflow by Adobe PSIRT, the vulnerability carries a CVSS 7.8 (High) rating. No public exploit or CISA KEV listing has been identified at time of analysis, but the file-based attack vector makes it suitable for phishing and malicious download campaigns targeting creative professionals.
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of the logged-in user when a crafted malicious file is opened. The vulnerability is rooted in improper memory boundary validation during file parsing (CWE-787), yielding full confidentiality, integrity, and availability impact per CVSS. No public exploit or CISA KEV listing has been identified at time of analysis, but the RCE-class severity and file-delivery vector make this a meaningful phishing or watering-hole risk for creative professionals.
Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 allows arbitrary code execution in the context of the logged-in user when a specially crafted file is opened. Adobe's PSIRT reported the issue under advisory APSB26-94, and the ENISA EUVD tracks it as EUVD-2026-56829. No public exploit or CISA KEV listing has been identified at time of analysis, though the CWE-787 memory corruption class combined with a confirmed high C/I/A impact triad warrants prompt patching across all affected release branches.
Unsafe deserialization of untrusted data in Adobe Lightroom Classic (versions ≤15.4.1) enables arbitrary code execution in the context of the authenticated user when a victim opens a specially crafted file. Classified as CWE-502, this file-format exploit carries a CVSS 3.1 score of 8.6 with changed scope (S:C), indicating impact extends beyond the Lightroom process itself to broader user-accessible system resources. No public exploit identified at time of analysis and no CISA KEV listing; Adobe has released a fix in version 15.5 via security bulletin APSB26-94.
SQL injection in Adobe Campaign Classic (ACC) v7 through 7.4.3 build 9399 allows a remote attacker to inject crafted SQL and achieve arbitrary code execution in the context of the current user, per Adobe advisory APSB26-123. The flaw is rated CVSS 9.0 (critical) with a scope change, but Adobe notes exploitation depends on conditions beyond the attacker's control (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is achievable by tricking a victim into opening a specially crafted malicious file, exploiting an integer overflow in the application's file parsing logic (CWE-190). The flaw yields full compromise of confidentiality, integrity, and availability within the current user's context, consistent with the CVSS 7.8 score. Adobe has released a patch in version 15.5 per advisory APSB26-94; no public exploit has been identified at time of analysis.
Arbitrary code execution in Adobe Campaign Classic (ACC) v7 through 7.4.3 build 9399 lets a remote, unauthenticated attacker run code in the context of the current user via an incorrect-authorization flaw (CWE-863). The maximum CVSS 3.1 base score of 10.0 reflects a network-reachable, no-interaction bug with a changed scope, meaning impact can extend beyond the initially vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated RCE and a vendor PSIRT advisory makes this a top-priority patch.
Path traversal in Adobe's Content Credentials toolkit - spanning the c2patool CLI, the c2pa Rust SDK, and the @contentauth/c2pa-web JavaScript/WASM SDK - enables arbitrary file-system reads outside intended directory boundaries on the local host. Affected versions include c2patool ≤ v0.27.5, c2pa-rs ≤ v0.90.5, and @contentauth/c2pa-web ≤ 0.12.0, with patched releases available for all three. No public exploit has been identified at time of analysis, but the scope-changed flag in the CVSS vector indicates that successful exploitation can reach resources beyond the vulnerable component's own security domain.
Uncontrolled resource consumption in Adobe's CAI Content Credentials SDK enables remote unauthenticated attackers to exhaust system resources and cause an application denial-of-service. Three distinct SDK components are affected: the Rust SDK (c2pa), the JavaScript/WebAssembly SDK (@contentauth/c2pa-web), and the command-line tool (c2patool), all across their respective versions prior to the patched releases. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is trivially exploitable without authentication or user interaction.
Null pointer dereference in Adobe's Content Credentials SDKs (Rust SDK ≤c2pa-v0.90.5, JS SDK ≤@contentauth/c2pa-web@0.12.1, CLI tool ≤c2patool-v0.27.5) enables unauthenticated remote attackers to crash any application built on these libraries by supplying a crafted C2PA media payload. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms straightforward remote exploitation with zero prerequisites or user involvement. No active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis; vendor-released patches are available for all three SDK components.
Incorrect Authorization (CWE-863) in Adobe ColdFusion 2023 and 2025 allows adjacent-network attackers to bypass authorization controls and execute arbitrary code in the context of the ColdFusion service account. The vulnerable administrative component is confined to an administrative network zone by default, limiting internet-scale exposure but leaving internal networks and misconfigured deployments at significant risk. No public exploit code or CISA KEV listing has been identified at time of analysis, though the complete CIA impact and zero-authentication requirement make this a high-priority patch target for any organization running ColdFusion.
OS command injection in Adobe ColdFusion 2023 and 2025 allows a low-privileged, network-authenticated attacker to bypass security controls and gain unauthorized write access to resources outside the application's normal permission boundary. The CVSS scope-change metric (S:C) confirms impact extends beyond the vulnerable component itself, meaning successful exploitation can affect the underlying operating system or adjacent system resources. No public exploit has been identified at time of analysis, but the low attack complexity and low privilege requirement make this a credible risk for any internet-exposed or internally accessible ColdFusion deployment.
Incorrect Authorization in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to bypass security controls and gain limited unauthorized read and write access to protected resources, with a limited disruption to availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication, no user interaction, and is reachable over the network under low complexity conditions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Improper Input Validation in Adobe ColdFusion 2023 and 2025 allows unauthenticated remote attackers to bypass security controls, gaining unauthorized read and limited write access to affected systems. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is a low-complexity, network-exploitable flaw requiring no privileges or user interaction, elevating real-world risk for any internet-facing ColdFusion deployment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but ColdFusion's history as a high-value target warrants prompt patching.
Heap-based buffer overflow in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to execute arbitrary code in the context of the ColdFusion server process. The vulnerability requires high-complexity exploitation conditions outside the attacker's direct control, yielding a CVSS score of 8.1 rather than critical, but the triple-high impact (full confidentiality, integrity, and availability compromise) makes it a high-priority target. No public exploit code or CISA KEV listing has been identified at time of analysis, though ColdFusion's historical targeting by ransomware and state-sponsored actors elevates real-world urgency beyond what the AC:H qualifier alone would suggest.
Hard-coded cryptographic key in Adobe ColdFusion 2023 and 2025 enables a local low-privileged attacker to bypass security controls and gain unauthorized read and write access with scope change to components beyond the vulnerable server. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H) confirms local access with minimal complexity is sufficient - no user interaction is needed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the deterministic, non-rotating nature of a hard-coded key means any attacker who extracts it retains persistent capability until the key is replaced via patch.
Sensitive memory disclosure in Adobe ColdFusion 2023 and 2025 stems from the server's use of a broken or risky cryptographic algorithm (CWE-327), enabling a remote unauthenticated attacker to retrieve confidential data - such as session tokens, credentials, or application secrets - that transit or reside in vulnerable cryptographic operations. Both the 2023 and 2025 product lines are confirmed affected per Adobe's own CPE data. No user interaction is required, and the CVSS vector confirms full network exploitability against default deployments. No public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in Adobe ColdFusion 2023 and 2025 enables remote, unauthenticated attackers to execute arbitrary operating-system commands in the context of the ColdFusion service account. Rated CVSS 10.0 with a scope change (S:C), this flaw stems from improper neutralization of special elements passed into an OS command and requires no user interaction. No public exploit identified at time of analysis, but ColdFusion's history as an attacker-favored target makes rapid patching essential.
Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrative user when a victim opens a crafted malicious file. The vulnerable component is restricted to the administrative network zone by default (AV:A), limiting exposure to internal or VPN-connected segments, but the scope change (S:C) with full CIA impact confirms that successful exploitation can cascade beyond the immediate ColdFusion application context. No public exploit has been identified at time of analysis; however, Adobe's advisory APSB26-90 confirms the RCE potential and the high severity rating of 8.8.
Security feature bypass in Adobe ColdFusion 2023 and 2025 lets attackers with adjacent network access defeat authorization checks (CWE-863, Incorrect Authorization) and obtain unauthorized read and write access, potentially forcing an application denial-of-service. The flaw carries a CVSS 9.6 (scope-changed) rating and requires no user interaction, though the vulnerable component sits inside an administrative network zone by default. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so treat the 9.6 as high potential rather than confirmed active abuse.
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and write access through an Incorrect Authorization flaw (CWE-863). Exploitation requires only a low-privileged local account and no user interaction, yielding full confidentiality, integrity, and availability impact on the affected system. Adobe has published advisory APSB26-90; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged authenticated attacker to gain unauthorized read and write access beyond their authorized security scope by exploiting improper input validation in file processing. The attack requires social engineering - a victim with higher privileges must open a specially crafted malicious file - after which the attacker's effective permissions cross security boundaries (scope change, S:C) to reach resources outside the original ColdFusion component. No public exploit or CISA KEV listing has been identified at time of analysis, though the high CVSS score of 8.7 and scope-change impact warrant prompt remediation per Adobe advisory APSB26-90.
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where improperly neutralized special elements in the template engine let an attacker run arbitrary code in the context of the current user. Any exposed ACC instance is affected, and per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote, low-complexity, and requires no privileges or user interaction, with a changed scope pushing the CVSS base score to a maximum 10.0. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the perfect score and SSTI class make it a high-priority patch target.
Privilege escalation in Adobe Campaign Classic (ACC) stems from an incorrect authorization flaw (CWE-863) that lets an attacker gain elevated privileges without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores it 9.8 Critical, implying a network-reachable, low-complexity path to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is currently theoretical based on the vendor advisory.
Remote code execution in Adobe Campaign Classic (ACC) lets an authenticated low-privileged attacker inject directives into dynamically evaluated code (CWE-95 eval injection) and run arbitrary code in the context of the current user. Because the CVSS scope is changed, the impact can reach components beyond the initially exploited one, driving the 9.6 critical score. Reported by Adobe with advisory APSB26-120; no public exploit identified at time of analysis and no CISA KEV listing.
Server-Side Request Forgery in Adobe Campaign Classic (ACC) enables remote attackers to coerce the server into issuing crafted internal requests, resulting in privilege escalation without any user interaction. Adobe rates the flaw at the maximum CVSS 10.0 with a changed scope, indicating the SSRF pivots beyond the vulnerable component to compromise other systems or trust boundaries. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, network-reachable nature makes it a top-priority patch.
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that escalate to arbitrary code execution in the context of the current user, per Adobe advisory APSB26-120. The CVSS 3.1 base score is a maximum 10.0 with a changed scope, reflecting network reachability, no privileges, no user interaction, and full confidentiality/integrity/availability impact spilling into adjacent components. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximum severity and unauthenticated network vector make this a top-priority patch.
Security feature bypass in Adobe Campaign Classic (ACC) exposes sensitive data to unauthenticated remote attackers via a violation of secure design principles (CWE-657). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms that exploitation requires no credentials, no user interaction, and low attack complexity against any network-accessible ACC instance, yielding high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis; Adobe has published advisory APSB26-120 addressing this issue.
SQL injection in Adobe Campaign Classic (ACC) allows a low-privileged, authenticated attacker to execute arbitrary code in the context of the current user without any user interaction. Because unsanitized input reaches an SQL command (CWE-89), an attacker with minimal access can pivot from database manipulation to code execution, and the CVSS scope change (S:C) indicates the impact extends beyond the vulnerable component itself. No public exploit identified at time of analysis, but the 9.9 base score and Adobe's own advisory (APSB26-120) mark this as a top-priority enterprise marketing-platform flaw.
Arbitrary code execution in Adobe Premiere Pro stems from an out-of-bounds write (CWE-787) triggered when processing a specially crafted media or project file, running code in the context of the logged-in user. The attack is file-based and local, requiring an adversary to socially engineer a victim - a realistic threat vector for creative professionals who routinely receive media files from external sources. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, but the high CVSS impact metrics (C:H/I:H/A:H) indicate full user-level compromise upon successful exploitation.
Arbitrary code execution in Adobe Campaign Classic (ACC) versions 7.4.3 build 9397 and earlier stems from an incorrect authorization flaw (CWE-863) that lets remote attackers run code in the context of the current user without any user interaction. Adobe's PSIRT reported the issue and rates it CVSS 9.8; it is tagged as an authentication-bypass-to-RCE chain. There is no public exploit identified at time of analysis, and it is not on CISA KEV, but SSVC flags the technical impact as total and the attack as automatable.
Sensitive data disclosure in Adobe Campaign Classic (ACC) allows a remote, unauthenticated attacker to read arbitrary files from the underlying host by exploiting an SQL injection flaw (CWE-89) that reaches file-system read primitives. Because the CVSS scope is changed and no user interaction is required, a single crafted request against an exposed ACC instance can leak sensitive memory and file contents (CVSS 8.6). There is no public exploit identified at time of analysis, but the network vector and low attack complexity make this a high-priority patch.
Out-of-bounds write in Adobe Bridge allows arbitrary code execution when a user opens a malicious file. The vulnerability requires user interaction and runs code in the context of the current user. No active exploitation or public exploit code is known at the time of analysis.
We need to parse the input data and produce a JSON object with the specified fields. The description: "Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed." CVSS 3.1 vector: AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, score 8.2. CWE-426: Untrusted Search Path. Tags: RCE, Adobe Bridge. SSVC: exploitation none, automatable no, technical impact total. Patch: there is no explicit patch data in the input, but references point to Adobe advisory: https://helpx.adobe.com/security/products/bridge/apsb26-89.html. The version ranges affected: "Adobe Bridge 0 ≤16.0.5" and "Adobe Bridge 0 ≤15.1.6" (probably meaning versions up to but not including? The EUVD says "Adobe Bridge 0 ≤16.0.5" and "0 ≤15.1.6" which is ambiguous — likely affected versions up to, but not including? Actually, it says "0 ≤16.0.5" which might indicate versions from 0 up to 16.0.5, so 16.0.5 is affected. But typical phrasing "versions up to and including 16.0.5". The advisory APSB26-89 might have more details. We'll note that affected products are Adobe Bridge versions up to 16.0.5 and 15.1.6, and presumably patch versions are later: 16.0.6 and 15.1.7? But the advisory isn't fully spelled out in input. We'll extract from the EUVD data: "Adobe Bridge 0 \u226416.0.5" means "Adobe Bridge 0 ≤16.0.5". So version 16.0.5 and earlier are affected. The referenced advisory likely states patched version 16.0.6. So remediation: update to version 16.0.6 (or 15.1.7 for 15.x branch). We'll incorporate that. We have no KEV status, so no active exploitation confirmed. No POC mentioned, but no explicit statement, so we'll say no public exploit identified. SSVC exploitation none, automatable no, so not easily automated. EPSS not provided, bu
Path traversal in Adobe Bridge allows local attackers to read arbitrary files from the victim's file system when a crafted malicious file is opened. Affected versions include all releases up to 15.1.6 and 16.0.5. No active exploitation or public PoC has been identified at this time, and the vendor has issued a fix via APSB26-89.
Arbitrary code execution in Adobe Bridge allows local attackers to execute arbitrary code in the victim's context by enticing a user to open a malicious file. The out-of-bounds write vulnerability (CWE-787) requires no authentication and has not been reported as actively exploited or in the CISA Known Exploited Vulnerabilities catalog. No public exploit code is known at this time.
Privilege escalation in Adobe Bridge allows unauthorized read and write access via a malicious file opened by a victim. Affected versions up to 15.1.6 and 16.0.5 are susceptible. Exploitation requires user interaction; a scope change can impact other system components, though no public exploit or active exploitation has been identified at time of analysis.
Arbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerability. A local attacker can craft a malicious file that, when opened by a victim, causes Bridge to load and execute a malicious DLL from an attacker-controlled location, leading to full system compromise in the context of the current user. No active exploitation or public exploit code is known at time of analysis, and EPSS data is not available.
Opening a malicious file in Adobe Bridge triggers an out-of-bounds write, leading to arbitrary code execution with the current user's privileges. Adobe has released a security update to address this issue via bulletin APSB26-89. No active exploitation or public exploit has been identified at the time of analysis.
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows an attacker to bypass security constraints and run code with the current user's privileges. No active exploitation or public proof-of-concept has been reported, but the vulnerability carries a high CVSS score due to scope change and full system impact.
Opening a malicious file in Adobe Format Plugins can trigger a heap-based buffer overflow, allowing arbitrary code execution in the context of the current user. Exploitation requires user interaction, and no active exploitation or public exploit code has been reported at this time.
We need to produce a JSON object with multiple fields. Let's analyze the input. CVE ID: CVE-2026-48388 Description: Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the installer. Exploitation of this issue required user interaction in that a victim must have been running the installer. Scope is changed. CVSS Score: 8.6 CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CWE: CWE-427 Multi-source: Reported by Adobe. CPE: cpe:2.3:a:adobe:adobe_photoshop_installer:*:*:*:*:*:*:*:* (all versions?). Tags: Adobe, RCE, Adobe Photoshop Installer. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. ENISA EUVD ID. Affected versions from EUVD: ["Adobe Photoshop Installer 0 ≤N/A"] - weird, maybe that's not precise. References: cveorg link (None?) and euvd advisory NVD link. Now, we must fill out all fields. No arrays, no nested JSON, plain text strings. product_name: 1-3 words ONLY. Affected product is "Adobe Photoshop Installer". So "Adobe Photoshop Installer". That's 3 words. Could also be just "Photoshop Installer" but better to include "Adobe". I'll output "Adobe Photoshop Installer". summary: 2-3 sentence plain-language synthesis. Not copying description. Should start with specific impact and product, e.g., "Arbitrary code execution in Adobe Photoshop Installer allows..." but careful: it's the installer, not Photoshop itself. The vulnerability is uncontrolled search path element (DLL hijacking). The attacker places a malicious library in a directory searched by the installer, and when the victim runs the installer, arbitrary code executes in the current user context. User interaction required. Use all data: SSVC says not exploited (none), not automatable, total impact. EPSS? None provided. KEV? Not mentioned.
Arbitrary code execution in Adobe DNG SDK version 1.7.1 (build 2536) and earlier arises from a stack-based buffer overflow triggered when parsing a maliciously crafted image file, allowing an attacker to run code in the context of the current user. Applications that embed the DNG SDK to decode Digital Negative (DNG) raw camera files are affected, and successful exploitation requires the victim to open the malicious file. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Arbitrary code execution in Adobe Acrobat Reader arises from a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted file, allowing an attacker to run code in the context of the current user. All affected versions covered by Adobe advisory APSB26-63 are impacted, and successful exploitation grants full high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, so risk is currently latent rather than active.
Denial-of-service in Adobe's C2PA / Content Credentials SDKs allows a remote attacker to crash any application built on the c2pa Rust SDK (≤0.84.0), the c2patool command-line utility (≤0.16.5), or the @contentauth/c2pa-web JavaScript SDK (≤0.7.0) by supplying malformed input that the library fails to validate. Because exploitation requires no authentication and no user interaction, an application that ingests attacker-controlled assets or manifests can be reliably knocked offline. There is no public exploit identified at time of analysis, and the low EPSS (0.41%) with CISA SSVC exploitation status of 'none' indicates no observed activity yet, though the flaw is assessed as automatable.
Denial-of-service in Adobe's Content Credentials (C2PA) SDK ecosystem lets a remote attacker crash any application that ingests attacker-supplied C2PA-signed assets. The flaw stems from improper input validation (CWE-20) in the Rust c2pa SDK, the @contentauth/c2pa-web JS SDK, and the c2patool command-line utility; exploitation requires no user interaction and no authentication (CVSS 7.5, A:H). No public exploit code has been identified and it is not in CISA KEV, though CISA's SSVC framework flags it as automatable, meaning a working exploit could be scaled easily.
Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) allows an attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw is an out-of-bounds write (CWE-787) triggered during file parsing and requires user interaction, so it is not remotely exploitable without victim action. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low (0.14%, 4th percentile), indicating no evidence of active exploitation.
Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) stems from an out-of-bounds write when parsing a maliciously crafted file, letting an attacker run code in the context of the current user. Exploitation requires the victim to open a booby-trapped file, so it is a file-format/client-side attack rather than a remotely reachable service flaw. No public exploit has been identified at time of analysis (SSVC exploitation: none), and EPSS is low at 0.14% (4th percentile).
Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) allows a remote attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw is an out-of-bounds write (CWE-787) with total technical impact per CISA SSVC, but no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile). Exploitation hinges on user interaction, so it is a file-delivery/social-engineering vector rather than a remotely automatable one.
Arbitrary code execution in Adobe Illustrator 2025 (≤29.8.7) and 2026 (≤30.5) allows an attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw stems from improper input validation (CWE-20) during file parsing and carries a scope-changed CVSS of 9.3, but there is no public exploit identified at time of analysis and EPSS is low at 0.39% (31st percentile). CISA SSVC rates exploitation as none with total technical impact, indicating high potential damage but no observed weaponization.
Credential disclosure in Adobe's CAI Content Credentials (C2PA) tooling - spanning the Rust SDK (c2pa ≤0.84.0), the JS SDK (@contentauth/c2pa-web ≤0.7.0), and the c2patool command-line utility (≤0.16.5) - allows a remote attacker to gain unauthorized read access to sensitive credentials due to insufficient protection of stored secrets (CWE-522). The CVSS 3.1 vector (AV:N/PR:N/UI:N, C:H) rates it 7.5 High with no authentication or user interaction required. There is no public exploit identified at time of analysis, CISA SSVC lists exploitation as none, and EPSS is low at 0.39% (31st percentile), so no active exploitation is evidenced.
Server-Side Request Forgery in Adobe's C2PA (Content Credentials) SDK family - the Rust SDK (c2pa), the Node.js web SDK (c2pa-web), and the c2patool CLI - can escalate to arbitrary code execution in the context of the current user. When an application built on these libraries validates a maliciously crafted asset or URL, the SSRF is chained into script injection to hijack the victim's session or account. No public exploit has been identified at time of analysis, and the EPSS score is low (0.18%, 7th percentile), consistent with CISA SSVC rating exploitation as 'none'.
Arbitrary code execution in Adobe's Content Authenticity (CAI) Content Credentials tooling — the c2pa Rust SDK (≤0.84.0), the @contentauth/c2pa-web JS SDK (≤0.7.0), and the c2patool CLI (≤0.16.5) — arises from an untrusted search path (CWE-426) that loads attacker-controlled libraries and runs code as the current user. Adobe PSIRT reports the flaw requires victim interaction (visiting a crafted URL or interacting with a compromised page) and a local attack vector, and there is no public exploit identified at time of analysis. EPSS is low (0.14%, 4th percentile) and CISA SSVC records exploitation as 'none', consistent with a not-yet-exploited but total-technical-impact issue.
Arbitrary code execution in Adobe Illustrator Desktop (2026 versions ≤30.5 and 2025 versions ≤29.8.7) allows an attacker to run code in the context of the current user when a victim opens a maliciously crafted file that abuses an untrusted search path (CWE-426). The flaw carries a CVSS 3.1 score of 8.6 with a changed scope, but exploitation is local and requires user interaction. There is no public exploit identified at time of analysis, EPSS is low (0.16%, 5th percentile), and CISA SSVC rates exploitation as none.
Server-side request forgery in Adobe ColdFusion lets a low-privileged, authenticated attacker coerce the server into issuing crafted outbound requests, bypassing a security control and gaining unauthorized read access to resources the attacker should not reach. The CVSS 3.1 scope-changed vector (S:C, C:H) indicates the impact extends beyond ColdFusion itself to backend or internal systems it can reach. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; remediation is available via Adobe security bulletin APSB26-82.
Security feature bypass in Adobe ColdFusion allows a low-privileged, network-based attacker to defeat access controls and obtain unauthorized read access to data outside their intended authorization boundary. Adobe PSIRT classifies the root cause as improper input validation and tags it an authentication bypass; the CVSS 3.1 score is 7.7 with a changed scope, reflecting impact that crosses a security boundary. No public exploit has been identified at time of analysis, and no EPSS or CISA KEV data was provided.
Arbitrary code execution in Adobe ColdFusion allows an attacker with low-privileged access on an adjacent network to bypass authorization controls (CWE-863) and run code in the context of the current user, with a scope change that lets the impact extend beyond the vulnerable component. Adobe PSIRT reported the flaw and published advisory APSB26-82; it is tagged as RCE and authentication bypass with a CVSS 3.1 base score of 9.0. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the incorrect-authorization-to-RCE pattern in ColdFusion has historically drawn rapid attacker interest.
Missing authentication in Adobe ColdFusion allows an unauthenticated attacker on an adjacent network to trigger arbitrary code execution in the context of the current user, without any user interaction. The flaw (CWE-306) bypasses authentication on a critical function and carries a scope change, meaning the impact reaches beyond the vulnerable component. There is no public exploit identified at time of analysis, but the issue was reported by Adobe PSIRT and addressed in advisory APSB26-82.
SQL injection in Adobe ColdFusion 2023 and 2025 lets an attacker with high privileges inject crafted SQL that escalates to arbitrary code execution in the context of the current user, with a changed scope that extends impact beyond the vulnerable component. The flaw (CWE-89, CVSS 9.1) affects ColdFusion 2023 through Update 21 and ColdFusion 2025 through Update 10, requires no user interaction, and was disclosed by Adobe PSIRT. There is no public exploit identified at time of analysis, and EPSS is modest at 0.69% (49th percentile).
Code injection (CWE-94) in Adobe ColdFusion 2023 (Update 21 and earlier) and ColdFusion 2025 (Update 10 and earlier) allows a low-privileged, network-adjacent attacker to execute arbitrary code in the context of the current user without any user interaction. Because the CVSS scope is changed, successful exploitation can extend impact beyond the vulnerable component to the underlying host. There is no public exploit identified at time of analysis and the EPSS probability is low (0.43%, 35th percentile), but the near-maximum CVSS of 9.9 and Adobe's own PSIRT reporting make this a high-priority patch.
Privilege escalation in Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) allows an adjacent-network attacker to bypass authorization checks and gain unauthorized read and write access without any user interaction. Because the CVSS scope is changed, a successful exploit can affect resources beyond the vulnerable component. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the CWE-863 root cause and 9.3 base score make it a high-priority patch for internet-adjacent ColdFusion servers.
Reflected Cross-Site Scripting in Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) enables unauthenticated adjacent-network attackers to inject malicious scripts into a victim's browser session, achieving high-severity confidentiality and integrity impact through session hijacking or account takeover. Exploitation requires user interaction - a victim must open a malicious file - and CVSS scope change (S:C) reflects that the impact crosses from the ColdFusion server context into the victim's browser environment. EPSS sits at 3.75% raw probability but at the 89th percentile, indicating elevated relative risk among all CVEs; however, SSVC rates exploitation as 'none' and the vulnerability is not listed in CISA KEV, so no public exploit identified at time of analysis.
Arbitrary code execution in Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) arises from a path traversal weakness that lets an authenticated attacker with high privileges escape a restricted directory and run code in the context of the current user. Because the CVSS scope is changed (S:C), successful exploitation can affect resources beyond the vulnerable component, and CISA's SSVC rates the technical impact as total. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.93%), indicating no evidence of widespread automated exploitation yet.
Path traversal in Adobe ColdFusion allows an authenticated remote attacker (PR:L) to read arbitrary files outside the intended web/application scope by manipulating pathname input, per Adobe advisory APSB26-82. The flaw carries a critical 9.9 CVSS with a changed scope, meaning a successful read can reach files belonging to other security contexts on the host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Arbitrary code execution in Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) allows an unauthenticated attacker on an adjacent network to run code in the context of the current user via improper input validation, with no user interaction required and a scope change extending impact beyond the vulnerable component. Adobe (APSB26-82) rates it CVSS 9.6; there is no public exploit identified at time of analysis and CISA's SSVC framework reports exploitation status 'none'. EPSS estimates a 2.17% 30-day exploitation probability (80th percentile), notable but not extreme for a critical-rated ColdFusion RCE.
Arbitrary code execution in Adobe Bridge allows an attacker to run code in the context of the current user by tricking a victim into opening a maliciously crafted file that triggers an untrusted pointer dereference (CWE-822). The flaw is local and file-based, requiring user interaction; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation yields full impact on confidentiality, integrity, and availability limited to the privileges of the user running Bridge.
Arbitrary code execution in Adobe Bridge is possible through an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, running attacker code in the context of the current user. All versions covered by Adobe advisory APSB26-81 are affected, and while there is no public exploit identified at time of analysis, the local user-interaction attack pattern is consistent with weaponized document/asset lures. The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact once a victim is socially engineered into opening the file.
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap-based buffer overflow (CWE-122), letting an attacker run code in the context of the current user. The flaw was reported by Adobe and disclosed in advisory APSB26-81; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is file-borne and requires user interaction, so it is not remotely triggerable without a user opening attacker-supplied content.
Arbitrary code execution in Adobe Bridge results from an out-of-bounds write (CWE-787) that a victim triggers by opening a malicious file, running attacker-supplied code with the privileges of the current user. The flaw is local (AV:L) and requires user interaction, so it is a client-side, file-borne bug rather than a remotely reachable service vulnerability. No public exploit identified at time of analysis and it is not listed in CISA KEV; Adobe patched it in advisory APSB26-81.
Arbitrary code execution in Adobe Bridge arises from an integer overflow (CWE-190) triggered when a victim opens a maliciously crafted file, allowing an attacker to run code in the context of the current user. The flaw is local and requires user interaction, carrying a CVSS 7.8 (High) score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file, triggering an out-of-bounds write (CWE-787) that executes attacker-controlled code in the context of the current user. The flaw affects Adobe Bridge as reported by Adobe (advisory APSB26-81) and is rated CVSS 7.8; no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is local and hinges entirely on user interaction - the victim must open the malicious file.
Local arbitrary code execution in Adobe Creative Cloud Desktop lets a low-privileged user run code in the context of the current user by exploiting an uncontrolled search path (CWE-427) — the class of flaw where an application loads a library or executable from an attacker-influenced directory. Adobe (CVE-2026-48272) rates it CVSS 7.8, but the vector is local with high attack complexity and requires existing low-level privileges, and exploitation depends on conditions beyond the attacker's control. No public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a defense-in-depth patch rather than an emergency.
Local privilege escalation to arbitrary code execution affects the Adobe Creative Cloud Desktop application through a Time-of-check Time-of-use (TOCTOU) race condition, letting a low-privileged local attacker execute code and - because the CVSS scope is changed - impact resources beyond the initial security context. No user interaction is required, but the race is hard to win: exploitation depends on conditions beyond the attacker's control, reflected in the high attack complexity. At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV.
Arbitrary code execution in Adobe After Effects arises from an out-of-bounds write (CWE-787) that runs in the context of the current user when a victim opens a maliciously crafted project or media file. Adobe (via advisory APSB26-78) confirms the flaw; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 7.8 CVSS reflects high impact tempered by the local vector and required user interaction.
Arbitrary code execution in Adobe After Effects arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted project or media file, running attacker code with the privileges of the current user. Adobe self-reported the flaw in advisory APSB26-78; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 7.8 (High) rating reflects high confidentiality, integrity, and availability impact but is gated by required user interaction and local file delivery.
Arbitrary code execution in Adobe Premiere Pro is possible via a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted project or media file, running attacker code in the context of the current user. The flaw is local and requires user interaction, with no public exploit identified at time of analysis; Adobe self-reported it in advisory APSB26-76. CVSS 7.8 reflects high confidentiality, integrity, and availability impact but a local attack vector gated by the user opening a malicious file.
Arbitrary code execution in Adobe Premiere Pro via an out-of-bounds write (CWE-787) that lets an attacker run code in the context of the current user when a victim opens a maliciously crafted project or media file. The flaw is memory-corruption based and file-driven, requiring user interaction rather than network exposure; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS data was not provided, but the local, user-interaction-gated vector places this in the file-format/client-side attack category typical of Adobe desktop products.
Arbitrary code execution in Adobe Premiere Pro is possible when a victim opens a maliciously crafted project or media file, triggering an out-of-bounds write (CWE-787) that runs attacker code in the context of the current user. The flaw was reported by Adobe (advisory APSB26-76) and carries a CVSS 3.1 base score of 7.8 (local vector, requires user interaction). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently driven by the ease of social-engineering a user into opening a booby-trapped file.
Arbitrary code execution in Adobe Media Encoder arises from a stack-based buffer overflow (CWE-121) triggered when a victim opens a maliciously crafted media file, allowing an attacker to run code in the context of the current user. The CVSS 3.1 base score is 7.8 (local vector, user interaction required, no privileges needed). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is file-delivery-driven rather than remotely wormable.
Arbitrary code execution in Adobe Media Encoder is possible through an out-of-bounds write triggered when a victim opens a maliciously crafted media file, running attacker code in the context of the current user. The flaw was reported by Adobe and is addressed in advisory APSB26-72; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation hinges on user interaction (opening the file) and yields high impact to confidentiality, integrity, and availability.
Arbitrary code execution in Adobe Media Encoder is possible when a victim opens a maliciously crafted media file, triggering an out-of-bounds write (CWE-787) that runs attacker code in the context of the current user. The flaw is local and requires user interaction, so it is not remotely wormable, but successful exploitation grants full compromise of the user's session. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Adobe published advisory APSB26-72 addressing the issue.
Arbitrary code execution in Adobe Media Encoder arises from an out-of-bounds write (CWE-787) that lets a crafted media file corrupt memory and run attacker-controlled code in the context of the current user. Any user who opens a malicious file in the affected desktop application is at risk, with full loss of confidentiality, integrity, and availability on the host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary code execution in Adobe Animate 2023 and 2024 arises from an untrusted search path (CWE-426) flaw that lets a malicious file, when opened by a victim, load attacker-controlled code in the context of the current user. The issue was reported by Adobe (advisory APSB26-83), requires user interaction, and carries a CVSS 3.1 base score of 7.9 with a changed scope. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in Adobe Animate 2023 and 2024 allows an attacker to run commands in the context of the current user via an OS command injection flaw (CWE-78) triggered when a victim opens a maliciously crafted file. The scope-changed CVSS 3.1 score of 8.2 reflects that successful exploitation can affect resources beyond the vulnerable application. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the primary risk gate is social-engineering the victim into opening a hostile document.
Arbitrary code execution in Adobe Animate 2023 and 2024 allows an attacker to run OS commands in the context of the current user when a victim opens a maliciously crafted file. The flaw is an OS command injection (CWE-78) with no public exploit identified at time of analysis and no active exploitation reported in CISA KEV; risk hinges on social-engineering a user into opening the file. Adobe published fixes in advisory APSB26-83.
Arbitrary code execution in Adobe Animate 2023 and 2024 stems from an incorrect authorization (CWE-863) weakness that lets code run in the context of the current user. Adobe reported the flaw via advisory APSB26-83 with a CVSS 8.1 rating; exploitation requires no user interaction but depends on conditions outside the attacker's control (reflected in high attack complexity). There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Arbitrary code execution in Adobe Animate 2023 and 2024 arises from an Incorrect Authorization flaw (CWE-863) that lets a maliciously crafted file run code in the context of the current user. Exploitation requires the victim to open the attacker-supplied file and depends on conditions beyond the attacker's control, and there is no public exploit identified at time of analysis. Adobe self-reported the issue and published fixes in advisory APSB26-83.
Arbitrary code execution in Adobe Animate 2023 and 2024 stems from a path traversal weakness triggered when a victim opens a maliciously crafted file, letting an attacker run code in the context of the current user and reach files or directories outside intended restrictions. The flaw carries a CVSS 3.1 base score of 8.6 with a changed scope, reflecting impact beyond the initially vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation risk hinges on social-engineering a user into opening a rogue project file.
Incorrect Authorization (CWE-863) in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin enables remote unauthenticated attackers to bypass security controls and gain unauthorized read and limited write access to protected resources. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special network position, making it trivially automatable - a finding corroborated by SSVC's Automatable:yes designation. No public exploit or active exploitation has been identified at time of analysis, and EPSS sits at 0.53% (41st percentile), suggesting limited opportunistic exploitation activity despite the high CVSS score.
Incorrect Authorization in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Webhooks Plugin allows unauthenticated remote attackers to bypass security controls and gain unauthorized read and limited write access to protected resources. The full product ecosystem is affected across multiple active release lines, with vendor-confirmed July 2026 patches available via APSB26-73. No active exploitation has been confirmed (CISA KEV absent, SSVC exploitation: none), though the SSVC framework flags the attack as automatable - meaning mass scanning tools could trivially target exposed storefronts.