Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Dreamweaver Desktop can run malicious code when opening files

CVE-2026-21274 · published 9 months ago
Summary

Versions 21.6 and earlier of Adobe Dreamweaver Desktop let a specially crafted file cause unwanted code to run with the same rights as the logged‑in user. An attacker could use this to get around normal security checks, but the exploit only works if a user opens the malicious file. Update Dreamweaver Desktop to the latest version and train users not to open files from unknown sources.

What to do
  • Update adobe dreamweaver to version 21.7 or later.
Affected software
VendorProductAffected versions
adobe dreamweaver < 21.7
cpe:2.3:a:adobe:dreamweaver:*:*:*:*:*:*:*:*
adobe adobe dreamweaver desktop <= 21.6
Original advisory text
Dreamweaver Desktop | Incorrect Authorization (CWE-863)
Dreamweaver Desktop versions 21.6 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could leverage this vulnerability to bypass security measures and execute unauthorized code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published13 Jan 2026
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2026-21274 · NVD
CVE-2026-21274 · MITRE
Track software like this
Free during beta