CVE-2026-47910 Overview
CVE-2026-47910 affects Adobe Dreamweaver Desktop versions 21.7 and earlier. The vulnerability stems from an Incorrect Authorization weakness [CWE-863] that allows arbitrary file system read operations. An attacker can access sensitive files and directories outside the intended access scope. Exploitation requires user interaction, with a victim opening a malicious file. The scope is changed, meaning the impact extends beyond the vulnerable component itself.
Critical Impact
Successful exploitation enables arbitrary file system read access, exposing sensitive files outside the application's authorized scope through a maliciously crafted Dreamweaver file.
Affected Products
- Adobe Dreamweaver Desktop version 21.7
- Adobe Dreamweaver Desktop versions prior to 21.7
- All supported platforms running affected Dreamweaver Desktop builds
Discovery Timeline
- 2026-06-09 - CVE-2026-47910 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-47910
Vulnerability Analysis
The vulnerability is classified as Incorrect Authorization [CWE-863]. Dreamweaver Desktop fails to properly verify authorization when processing certain file operations. As a result, file system read requests bypass the access controls that should restrict them to the application's intended scope.
The scope change indicator means the vulnerable component grants access to resources managed by another security authority. In practical terms, an attacker reads files belonging to the user or system that the Dreamweaver process should not access. The confidentiality impact is high, while integrity and availability remain unaffected.
Exploitation requires local access combined with user interaction. The attacker cannot trigger the flaw remotely without convincing the victim to open a crafted file in Dreamweaver.
Root Cause
The root cause is missing or insufficient authorization checks within file handling routines in Dreamweaver Desktop. The application processes file references inside opened documents without confirming that the resolved paths fall within the user's intended access boundary. This logic gap permits the application to read arbitrary files when instructed by content embedded in a malicious project or document.
Attack Vector
The attack vector is local with required user interaction. An attacker delivers a malicious Dreamweaver file through phishing, file sharing, or a compromised project repository. When the victim opens the file in Dreamweaver, the embedded content directs the application to read files outside the expected scope. The attacker then retrieves the disclosed content through the same crafted document, a callback, or attacker-controlled output channels.
No verified public exploit code is available for this vulnerability. The vulnerability mechanism is described in the Adobe Security Advisory APSB26-62.
Detection Methods for CVE-2026-47910
Indicators of Compromise
- Dreamweaver process accessing files outside expected project directories or user document folders
- Unexpected Dreamweaver.exe reads against sensitive paths such as credential stores, SSH keys, or browser profile data
- Inbound .dwt, .htm, or Dreamweaver project files arriving from untrusted sources or external email
Detection Strategies
- Monitor Adobe Dreamweaver process file-read telemetry for accesses outside the user's active workspace
- Inspect Dreamweaver project files for unusual external references that point to system, configuration, or credential paths
- Correlate file open events with subsequent network egress from the Dreamweaver process for potential exfiltration
Monitoring Recommendations
- Enable endpoint file-access auditing for the Dreamweaver process and alert on reads of sensitive directories
- Track delivery of Dreamweaver project files through email gateways and shared storage to identify suspicious sources
- Maintain software inventory to identify hosts running Dreamweaver Desktop 21.7 and earlier for prioritized remediation
How to Mitigate CVE-2026-47910
Immediate Actions Required
- Update Adobe Dreamweaver Desktop to the version listed as fixed in Adobe Security Advisory APSB26-62
- Instruct users to avoid opening Dreamweaver files received from untrusted or unverified sources
- Audit endpoints for installations of Dreamweaver Desktop 21.7 and earlier and schedule remediation
Patch Information
Adobe published the fix in security bulletin APSB26-62. Administrators should consult the Adobe Security Advisory APSB26-62 for the patched version, download links, and platform-specific guidance. Apply the update through the Adobe Creative Cloud desktop application or enterprise deployment tooling.
Workarounds
- Restrict opening of Dreamweaver project files to those originating from trusted, controlled repositories
- Apply operating system file permissions that limit the Dreamweaver process from reading sensitive directories
- Run Dreamweaver under a least-privilege user account that lacks access to credential stores and other high-value files
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
