CVE-2026-75990: Adobe Illustrator Auth Bypass Vulnerability

CVE-2026-75990 Overview

Adobe Illustrator contains an Incorrect Authorization vulnerability [CWE-863] that enables arbitrary code execution in the context of the current user. An attacker crafts a malicious file and delivers it to a victim through email, download, or file share. When the victim opens the file in Illustrator, the application fails to properly enforce authorization checks, allowing attacker-controlled logic to execute. The scope changes during exploitation, meaning the impact extends beyond Illustrator's own security boundary. Adobe documented the flaw in security advisory APSB26-131.

Critical Impact
Successful exploitation grants arbitrary code execution under the current user's privileges and can affect resources outside the vulnerable component due to the changed scope.

Affected Products

Adobe Illustrator (versions listed in Adobe advisory APSB26-131)
Windows installations of Adobe Illustrator
macOS installations of Adobe Illustrator

Discovery Timeline

2026-09-08 - CVE-2026-75990 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-75990

Vulnerability Analysis

The flaw is an Incorrect Authorization weakness classified under [CWE-863]. Illustrator performs an authorization check when processing content in a crafted file, but the check does not correctly validate the requested action against the user's or component's permissions. An attacker uses this gap to invoke operations the application should have blocked, ultimately achieving code execution as the current user.

The advisory notes a scope change, indicating the vulnerable component and the impacted component differ. Code executed through the flaw can therefore reach data or capabilities that Illustrator's own trust boundary would normally isolate. Exploitation requires user interaction: the victim must open the malicious file locally.

Root Cause

The root cause is an authorization decision made without sufficient context or with an incorrect policy. When Illustrator parses attacker-controlled file structures, an internal routine treats the requested action as permitted even though the caller lacks the required rights. The application then dispatches the action, and attacker-supplied data drives execution.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious Illustrator-compatible file and delivers it through phishing, a shared drive, or a compromised website. When the target opens the file, Illustrator processes the malicious content and invokes the incorrectly authorized code path, resulting in arbitrary code execution in the user's session.

No public proof-of-concept is available, and no exploitation in the wild has been reported. See the Adobe Security Advisory APSB26-131 for vendor technical details.

Detection Methods for CVE-2026-75990

Indicators of Compromise

Unexpected child processes spawned by Illustrator.exe or the macOS Adobe Illustrator binary, particularly command interpreters such as cmd.exe, powershell.exe, bash, or zsh.
Illustrator writing executable content (.exe, .dll, .dylib, .scpt) into user-writable directories such as %APPDATA%, %TEMP%, or ~/Library/Application Support.
Recently opened .ai, .eps, .pdf, or .svg files originating from untrusted email attachments or downloads immediately preceding suspicious process activity.

Detection Strategies

Build endpoint detection rules that alert on Illustrator spawning scripting engines, LOLBins, or network-capable utilities.
Correlate file-open telemetry with subsequent process creation and outbound network connections from Illustrator's process tree.
Hunt for module loads of unsigned DLLs or dylibs into the Illustrator process, which can indicate injected payloads.

Monitoring Recommendations

Ingest process creation, file write, and module load events from workstations running Illustrator into a centralized analytics platform.
Alert on Illustrator process ancestry that includes email clients or browsers followed by execution of interpreters.
Track outbound connections initiated by Illustrator to non-Adobe domains and flag deviations from baseline behavior.

How to Mitigate CVE-2026-75990

Immediate Actions Required

Apply the Illustrator updates documented in Adobe advisory APSB26-131 to every affected workstation.
Inventory all endpoints running Illustrator and prioritize patching for users who routinely open externally sourced design files.
Instruct users to avoid opening Illustrator files from untrusted senders until patching is complete.

Patch Information

Adobe published fixed versions in security bulletin APSB26-131. Update Illustrator through the Adobe Creative Cloud desktop application or by downloading the patched installer from Adobe. Confirm the installed version matches or exceeds the fixed release listed in the advisory.

Workarounds

Restrict Illustrator use to trusted files only until the patch is applied.
Enforce application allowlisting so Illustrator cannot spawn scripting hosts or command shells.
Open suspect design files inside an isolated virtual machine or sandbox with no access to sensitive data or credentials.

bash

# Verify installed Illustrator version on macOS
defaults read "/Applications/Adobe Illustrator 2026/Adobe Illustrator.app/Contents/Info.plist" CFBundleShortVersionString

# Verify installed Illustrator version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Adobe Illustrator*" } |
  Select-Object DisplayName, DisplayVersion