SB2026071522 - Multiple vulnerabilities in Adobe Animate

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026071522

SB2026071522 - Multiple vulnerabilities in Adobe Animate

Published: July 15, 2026

Security Bulletin ID SB2026071522
CSH Severity
High
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 83% Low 17%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Path traversal (CVE-ID: CVE-2026-48350)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to path traversal in Adobe Animate when processing crafted input. A remote attacker can provide crafted input to execute arbitrary code.

User interaction is required to trigger the issue.


2) OS Command Injection (CVE-ID: CVE-2026-48345)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to command injection in Adobe Animate when processing crafted input. A local user can provide crafted input to execute arbitrary code.

User interaction is required to trigger the issue.


3) Untrusted search path (CVE-ID: CVE-2026-48346)

CWE-ID: CWE-426 - Untrusted Search Path

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an untrusted search path in Adobe Animate when loading resources. A local user can influence the search path to execute arbitrary code.

User interaction is required to trigger the issue.


4) OS Command Injection (CVE-ID: CVE-2026-48347)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a local privileged user to execute arbitrary code.

The vulnerability exists due to command injection in Adobe Animate when processing crafted input. A local privileged user can provide crafted input to execute arbitrary code.

User interaction is required to trigger the issue.


5) Incorrect authorization (CVE-ID: CVE-2026-48348)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to incorrect authorization in Adobe Animate when processing crafted input. A remote attacker can provide crafted input to execute arbitrary code.

User interaction is required to trigger the issue.


6) Incorrect authorization (CVE-ID: CVE-2026-48349)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to incorrect authorization in Adobe Animate when processing crafted input. A remote attacker can provide crafted input to execute arbitrary code.


Remediation

Install update from vendor's website.

References