CVE-2026-21268CWE-20

CVE-2026-21268

High · published January 14, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
16.1
In the wild
Unconfirmed
What it is

⚡ User interaction is the key here! If a victim opens a malicious file in Dreamweaver Desktop versions 21.6 or earlier, it could lead to arbitrary code execution — quite the risky art project! 🎨 Think of it like a restaurant where a chef prepares special dishes without checking the ingredients. If a sneaky diner submits a recipe with a hidden allergen, it could endanger everyone who tries that dish! An attacker could take control of the user's system, executing arbitrary code with the same permissions as the logged-in user. This could mean anything from stealing sensitive data to wreaking havoc on files — an absolutely devastating scenario! 🔥

Put simply

Think of it like a restaurant where a chef prepares special dishes without checking the ingredients. If a sneaky diner submits a recipe with a hidden allergen, it could endanger everyone who tries that dish! This vulnerability arises due to improper input validation in Dreamweaver, allowing attackers to exploit the application if a user opens a specially crafted file. This could lead to arbitrary code execution under the current user’s context.

What to do

An attacker could take control of the user's system, executing arbitrary code with the same permissions as the logged-in user. This could mean anything from stealing sensitive data to wreaking havoc on files — an absolutely devastating scenario! 🔥 To mitigate this risk, ensure that Dreamweaver is updated to the latest version beyond 21.6. Educate users to be cautious when opening files from untrusted sources, and consider implementing security measures that restrict the execution of unverified code. You've got this! Stay vigilant, update promptly, and keep that system fortified! 🛡️

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00255 · 16.1th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-01-14T00:16Z
Affected products (1)
ProductVersionsFixed in
adobe/dreamweaver< 21.721.7
References (1)
EPSS history
Timeline
  • 13 JAN 18:25Z
    Dreamweaver Desktop | Improper Input Validation (CWE-20)
    cvelistv5