CVE-2026-48349 Animate | Incorrect Authorization (CWE-863)
Adobe Animate allows arbitrary code execution due to incorrect authorization checks, requiring no user interaction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-48349?
CVE-2026-48349 is a high-severity missing authorization vulnerability in Adobe Animate, published on 14 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
Weakness: CWE-863
Which versions are affected by CVE-2026-48349?
It affects 1 product.
Products include Adobe Animate.
How do I fix CVE-2026-48349?
No fix has been published for CVE-2026-48349 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-48349 being exploited?
There is no known exploitation of CVE-2026-48349 in the wild and no public exploit code.
Other vulnerabilities in Adobe Animate
- CVE-2016-7866 Memory corruption in Adobe Animate 15.2.1.95 and earlier
- CVE-2026-48350 Animate | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- CVE-2026-76191 Animate | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- CVE-2026-48345 Animate | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- CVE-2026-48346 Animate | Untrusted Search Path (CWE-426)
Sources
Also known as GHSA-668q-r655-w2wj.