#202020

Adobe Security Bulletin

Last updated on January 13, 2026

Security update available for Adobe Dreamweaver | APSB26-01

Bulletin ID
Date published
Priority
APSB26-01
January 13, 2026
3
style
grid width 12

Summary

Adobe has released a security update for Adobe Dreamweaver. This update resolves critical and important vulnerabilities that could lead to arbitrary code execution and arbitrary file system write.

Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.

Affected versions

Product
Affected versions
Platform
Adobe Dreamweaver
21.6 and earlier versions
Windows and macOS
style
grid width 12

Solution

Adobe categorizes this update with the following priority rating and recommends users to use latest builds for new installation via the Creative Cloud desktop app updater, or by navigating to the Dreamweaver Help menu and clicking "Updates." For more information, please reference this help page.

Product
Updated Version
Platform
Priority rating
Adobe Dreamweaver
21.7
Windows and macOS
3
style
grid width 12

Note

For managed environments, IT administrators can use the Creative Cloud Packager to create deployment packages. Refer to this help page for more information on the Creative Cloud Packager.

style
xl spacing, one up, grid width 8, static-links, xxl-spacing-top

Vulnerability Details

CVE-2026-21267
Vulnerability category: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 8.6
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVE-2026-21268
Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 8.6
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVE-2026-21274
Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-21271
Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 8.6
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVE-2026-21272
Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Arbitrary file system write
Severity: Critical
CVSS base score: 8.6
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
style
grid width 12

Acknowledgements

Adobe would like to thank the following researcher for reporting these issues and for working with Adobe to help protect our customers:

  • Sudhanshu Rajbhar (sudi): CVE-2026-21267, CVE-2026-21268, CVE-2026-21272, CVE-2026-21274
  • Kieran (kaiksi): CVE-2026-21271

NOTE: Adobe has a public bug bounty program with Intigriti. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail.

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com.

CardTitle
APSB26-01
CardDescription
Priority 3 Security update
CardImage
Adobe
Created
2026-01-13
Tags
caas:content-type/documentation,caas:trust-center/security-bulletin,caas:products/dreamweaver
PrimaryTag
caas:content-type/article
Details
caas:mnemonics/dreamweaver
Arbitrary
search: CVE-2026-21267 CVE-2026-21268 CVE-2026-21274 CVE-2026-21271 CVE-2026-21272