What’s Vulnerable › Vulnerabilities

CVE-2023-26358: Adobe Creative Cloud AdobeExtensionService.exe local privilege escalation vulnerability

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-22 · updated 2026-06-17
• Weakness: CWE-426

Description

Creative Cloud version 5.9.1 (and earlier) is affected by an Untrusted Search Path vulnerability that might allow attackers to execute their own programs, access unauthorized data files, or modify configuration in unexpected ways. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. The problem extends to any type of critical resource that the application trusts.

Affected products

• Adobe Creative Cloud Desktop Application: before 5.10 — fixed in 5.10

How to fix

Upgrade to a fixed version: Adobe Creative Cloud Desktop Application 5.10. Check the vendor advisory for mitigations.

References

• https://helpx.adobe.com/security/products/creative-cloud/apsb23-21.html
• https://helpx.adobe.com/security/products/creative-cloud/apsb23-21.html

Get alerted when CVE-2023-26358 or the next vulnerability affects your stack