CVE-2026-47907: Adobe Dreamweaver Desktop Improper Access Control

Technical summary

CVE-2026-47907 is an improper access control vulnerability (CWE-284) affecting Adobe Dreamweaver Desktop through version 21.7 on Windows and macOS platforms. The vulnerability allows arbitrary code execution within the context of the current user by bypassing access controls that should restrict certain operations. The CVSS v3.1 score of 8.6 reflects high impact across confidentiality, integrity, and availability, with local attack vector, low attack complexity, no privilege requirement, and user interaction required. The scope change indicates that the impact extends beyond the vulnerable component itself, potentially affecting the underlying operating system or other applications running under the user's session.

Business impact

Organizations relying on Dreamweaver for web design and development work face exposure to supply chain and insider threat risks if developers open untrusted project files or collaborate on externally sourced design assets. Compromised machines could lead to injection of malicious code into web applications, theft of intellectual property, exposure of API keys or database credentials embedded in projects, and lateral movement into internal networks. For agencies or teams handling sensitive web properties, this vulnerability could undermine the integrity of production deployments and customer-facing systems.

Affected systems

Adobe Dreamweaver Desktop versions 21.7 and earlier are affected. The vulnerability impacts both Windows and macOS deployments. Users running version 21.8 and later are not affected by this specific flaw. Organizations should verify their exact Dreamweaver version across development teams to identify exposure. The vulnerability does not affect Dreamweaver cloud-based or web-hosted variants—only the desktop application.

Exploitability

Exploitation requires user interaction: a victim must open a malicious file in Dreamweaver for code execution to occur. This is a practical but not trivial barrier, as it relies on social engineering or phishing to deliver the weaponized file. The attack surface is moderate—any employee with Dreamweaver installed and access to email or file sharing is a potential target. Once a user opens the malicious file, no additional steps are required; code execution happens automatically. The vulnerability is not actively exploited in the wild according to current KEV data, but the high CVSS score and ease of exploitation once user interaction is achieved mean the threat level will likely increase after public disclosure or proof-of-concept release.

Remediation

Adobe has patched this vulnerability in Dreamweaver Desktop version 21.8 and later. Organizations should upgrade all Dreamweaver installations to version 21.8 or the latest available release as soon as possible. Interim mitigation includes restricting file opening from untrusted sources, disabling auto-opening of design files from email clients, and educating developers to be cautious when opening .psd, .xd, or project files from external collaborators. For teams unable to patch immediately, consider limiting Dreamweaver to isolated development machines without access to sensitive production systems.

Patch guidance

Upgrade Adobe Dreamweaver Desktop to version 21.8 or later. Adobe typically releases patches through the Creative Cloud desktop application or direct download from adobe.com. Verify your current version by launching Dreamweaver and checking Help > About Dreamweaver. Organizations with Creative Cloud enterprise licensing should coordinate patches through their IT deployment tool or Adobe's update service. Test patched versions in a non-production environment first to ensure compatibility with existing projects and extensions. Plan patching during scheduled maintenance windows to minimize disruption to design teams.

Detection guidance

Monitor Dreamweaver process execution for suspicious child processes (cmd.exe, powershell.exe, bash) spawned during file opening. Log file access patterns to identify when project files are opened from unusual locations (temp directories, downloads, network shares) or by unexpected users. Endpoint detection and response (EDR) tools should flag execution anomalies following Dreamweaver launch. Network monitoring can detect outbound connections from Dreamweaver processes to command-and-control infrastructure. Consider deploying file integrity monitoring on directories containing critical design assets to detect unauthorized modification. Review file server logs for access to Dreamweaver project files from compromised or suspicious user accounts.

Why prioritize this

This vulnerability merits immediate patching priority due to its high CVSS score (8.6), broad platform coverage (Windows and macOS), and the widespread use of Dreamweaver across design and development teams. The requirement for user interaction is offset by the ease of social engineering attacks targeting collaborative workflows. Unlike vulnerabilities requiring advanced exploitation or special privileges, this can be weaponized with minimal effort and executed by low-skill attackers. The scope change compounds risk by allowing compromise of the wider system beyond Dreamweaver itself. Organizations should prioritize patching creative teams within 14 days of patch availability.

Risk score, explained

The CVSS v3.1 score of 8.6 (HIGH severity) reflects multiple aggravating factors: unrestricted code execution in the user context (confidentiality, integrity, and availability all rated high), a local attack vector with low complexity, absence of privilege requirements, and a change in scope that extends impact to the underlying OS and other user-context processes. The score would be higher (9.0+) if no user interaction were required, but the practical social engineering risk keeps it in the high range. This is a legitimate 'critical-tier' vulnerability for organizations with large design or web development teams.

Frequently asked questions