CVE-2026-21280

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21280", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "state": "PUBLISHED", "assignerShortName": "adobe", "dateReserved": "2025-12-12T22:01:18.188Z", "datePublished": "2026-01-13T18:41:21.310Z", "dateUpdated": "2026-08-27T21:57:05.549Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Illustrator Desktop 2026", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "30.0", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "30.1", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Illustrator Desktop 2025", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "29.8.3", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "29.8.4", "versionType": "semver"}]}], "datePublic": "2026-01-13T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical resources such as programs, an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 8.6, "environmentalSeverity": "HIGH", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "LOCAL", "modifiedAvailabilityImpact": "HIGH", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedScope": "CHANGED", "modifiedUserInteraction": "REQUIRED", "privilegesRequired": "NONE", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "CHANGED", "temporalScore": 8.6, "temporalSeverity": "HIGH", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-426", "description": "Untrusted Search Path (CWE-426)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T21:57:05.549Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://helpx.adobe.com/security/products/illustrator/apsb26-03.html"}], "source": {"discovery": "EXTERNAL"}, "title": "Illustrator | Untrusted Search Path (CWE-426)", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21280", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-14T04:57:37.577103Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:04:14.949Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21280", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-14T04:57:37.577103Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T19:01:23.087Z"}}], "cna": {"title": "Illustrator | Untrusted Search Path (CWE-426)", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "modifiedScope": "CHANGED", "temporalScore": 8.6, "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "HIGH", "availabilityImpact": "HIGH", "environmentalScore": 8.6, "privilegesRequired": "NONE", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "LOCAL", "confidentialityImpact": "HIGH", "environmentalSeverity": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "HIGH", "modifiedUserInteraction": "REQUIRED", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedConfidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Adobe", "product": "Illustrator Desktop 2026", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "30.0"}, {"status": "unaffected", "version": "30.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Adobe", "product": "Illustrator Desktop 2025", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "29.8.3"}, {"status": "unaffected", "version": "29.8.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-01-13T17:00:00.000Z", "references": [{"url": "https://helpx.adobe.com/security/products/illustrator/apsb26-03.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical resources such as programs, an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-426", "description": "Untrusted Search Path (CWE-426)"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T21:57:05.549Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21280", "state": "PUBLISHED", "dateUpdated": "2026-08-27T21:57:05.549Z", "dateReserved": "2025-12-12T22:01:18.188Z", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "datePublished": "2026-01-13T18:41:21.310Z", "assignerShortName": "adobe"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Illustrator Desktop 2026", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "30.0", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "30.1", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Illustrator Desktop 2025", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "29.8.3", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "29.8.4", "versionType": "semver"}]}], "source": "psirt@adobe.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:illustrator:*:*:*:*:*:*:*:*", "matchCriteriaId": "51DBEB22-5A04-40DC-BF47-0A6711977FBA", "versionEndExcluding": "29.8.4", "versionStartIncluding": "29.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:illustrator:30.0:*:*:*:*:*:*:*", "matchCriteriaId": "7239093D-0266-4AFA-BA6C-94F6593E0B4B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical resources such as programs, an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed."}, {"lang": "es", "value": "Las versiones 29.8.3, 30.0 y anteriores de Illustrator se ven afectadas por una vulnerabilidad de Ruta de B\u00fasqueda No Confiable que podr\u00eda resultar en ejecuci\u00f3n de c\u00f3digo arbitrario en el contexto del usuario actual. Si la aplicaci\u00f3n utiliza una ruta de b\u00fasqueda para localizar recursos cr\u00edticos como programas, un atacante podr\u00eda modificar esa ruta de b\u00fasqueda para que apunte a un programa malicioso, que la aplicaci\u00f3n objetivo ejecutar\u00eda entonces. La explotaci\u00f3n de este problema requiere interacci\u00f3n del usuario, en el sentido de que la v\u00edctima debe abrir un archivo malicioso y el alcance se modifica."}], "id": "CVE-2026-21280", "lastModified": "2026-08-28T00:16:50.490", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 6.0, "source": "psirt@adobe.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21280", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-14T04:57:37.577103Z", "version": "2.0.3"}}]}, "published": "2026-01-13T19:16:25.693", "references": [{"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/illustrator/apsb26-03.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-426"}], "source": "psirt@adobe.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T06:34:28.812317+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest Adobe Illustrator release that contains the fix for the untrusted search path issue.", "Remove or disable older Illustrator installations that are vulnerable to prevent accidental use.", "Educate users to avoid opening files from untrusted sources and verify file associations before execution."], "summary": {"action": "Immediate patch", "impact": "Arbitrary code execution"}, "threat_synthesis": {"affected_systems": "Adobe Illustrator versions 29.8.3, 30.0 and every earlier release on macOS and Windows are affected.", "description_and_impact": "The vulnerability arises from Adobe Illustrator\u2019s handling of untrusted search paths when locating critical resources such as executable programs. The application does not verify that the program found on the search path comes from a trusted directory, allowing an attacker to place a malicious executable in a location the path resolves to. If a victim opens a crafted file, Illustrator will launch that program in the context of the current user, enabling arbitrary code execution.", "risk_and_exploitability": "The CVSS score of 8.6 indicates high severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The flaw requires user interaction, so it is not a remote exploit but can be targeted to individual users who open malicious files. It is not listed in the CISA KEV catalog, but due to the high impact of execution, organizations should treat it as a critical issue."}}}}, "created": "2026-01-14T11:08:35.850691+00:00", "updated": "2026-04-18T06:45:23.959313+00:00", "vendors": ["adobe", "adobe$PRODUCT$illustrator"]}