CVE-2026-76196: Adobe Photoshop Mobile Privilege Escalation

CVE-2026-76196 Overview

Adobe Photoshop Mobile for Android contains a session fixation vulnerability [CWE-384] that can lead to privilege escalation. An attacker who successfully exploits this flaw could gain access to sensitive resources tied to the victim's authenticated session. Exploitation requires user interaction, specifically that the victim visits a malicious webpage, and depends on conditions outside the attacker's control. The vulnerability has a scope change, meaning impact extends beyond the vulnerable component to other resources. Adobe published a security advisory tracking this issue under APSB26-136.

Critical Impact
Successful exploitation allows an attacker to hijack an authenticated session, escalate privileges, and access sensitive user data managed by Photoshop Mobile.

Affected Products

Adobe Photoshop Mobile for Android (all versions prior to the fix in APSB26-136)

Discovery Timeline

2026-09-08 - CVE-2026-76196 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-76196

Vulnerability Analysis

The vulnerability is a session fixation flaw in Adobe Photoshop Mobile for Android. In a session fixation attack, the application accepts a session identifier supplied by an attacker rather than issuing a fresh identifier after authentication. When the victim later authenticates using that pre-set identifier, the attacker gains access to the resulting authenticated session.

Because the CVSS scope is changed, the compromised session grants access to resources beyond the vulnerable component itself. This enables privilege escalation on the affected device or associated Adobe services. Both confidentiality and integrity of user data are impacted, while availability is unaffected.

Root Cause

The root cause aligns with CWE-384: Session Fixation. The application does not invalidate or regenerate the session identifier at authentication boundaries. An attacker who can plant or coerce a known session identifier into the victim's client can therefore predict the authenticated session token.

Attack Vector

The attack vector is local and requires user interaction. A victim must interact with a malicious webpage, which delivers or fixes a session identifier the attacker controls. Successful exploitation additionally depends on race conditions or environmental factors outside the attacker's control, which contributes to the high attack complexity rating. Refer to the Adobe Photoshop Security Advisory for further technical context.

// No verified proof-of-concept code is publicly available for CVE-2026-76196.
// See the Adobe advisory APSB26-136 for vendor-provided technical details.

Detection Methods for CVE-2026-76196

Indicators of Compromise

Repeated authentication events for the same Adobe account reusing an identical session identifier across different devices or network origins.
Unexpected access to Adobe cloud assets, project files, or account settings from Photoshop Mobile sessions that do not match the user's device fingerprint.
Mobile browser referrals from unknown domains immediately preceding a Photoshop Mobile authentication event.

Detection Strategies

Correlate Adobe identity provider logs with mobile device inventory to flag session tokens reused across dissimilar user agents or IP ranges.
Inspect mobile web traffic for URLs containing session or token parameters targeting Photoshop Mobile deep links or authentication callbacks.
Monitor for anomalous OAuth or SSO flows initiated from Android WebViews associated with Photoshop Mobile.

Monitoring Recommendations

Enable verbose authentication and session lifecycle logging on Adobe enterprise tenants where available.
Alert on privilege escalation events within Adobe Creative Cloud where the initiating client is a mobile device running an outdated Photoshop Mobile build.
Track mobile application version telemetry to identify endpoints still running vulnerable Photoshop Mobile builds.

How to Mitigate CVE-2026-76196

Immediate Actions Required

Update Adobe Photoshop Mobile for Android to the version listed as fixed in Adobe advisory APSB26-136.
Force reauthentication for all Adobe Creative Cloud sessions initiated from mobile devices.
Instruct users to avoid opening untrusted links that request Photoshop Mobile to open or authenticate.

Patch Information

Adobe has released a fixed version of Photoshop Mobile addressed under Adobe Security Bulletin APSB26-136. Administrators should deploy the patched build through their mobile device management platform and verify installation across managed Android devices.

Workarounds

Restrict installation of Photoshop Mobile to managed devices where MDM policies can enforce the patched version.
Disable deep linking or intent handling for Photoshop Mobile on devices that cannot be updated promptly.
Educate users to authenticate to Adobe services only from the app's native login flow, not from webpage-initiated prompts.

bash

# Verify the installed Photoshop Mobile version on a managed Android device
adb shell dumpsys package com.adobe.psmobile | grep versionName