Loading vulnerability…
OS Command Injection in Adobe Animate
CVE-2026-48345 is an OS command injection vulnerability in Adobe Animate caused by improper neutralization of special elements used in an operating-system command. It affects Adobe Animate 2023 through version 23.0.15 and Adobe Animate 2024 through version 24.0.13. A malicious file can cause Animate to execute attacker-controlled commands when opened by a victim, resulting in arbitrary code execution in the context of the current user. The vulnerability has changed scope.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution with the privileges of the user running Adobe Animate. An attacker could execute programs and access, modify, or delete data available to that user. The effect is greater when Animate is run by an administrative or otherwise highly privileged account. The CVSS v3.1 vector indicates high confidentiality, integrity, and availability impact and changed scope.
If you can’t patch tonight, do this now.
Until updates are deployed, restrict opening of untrusted Animate files, especially files obtained through unsolicited messages or untrusted downloads. Run Animate under non-administrative accounts, enforce least privilege, and use application allowlisting, endpoint detection and response, and exploit-prevention controls to limit malicious child-process execution.
Patch, then assume compromise.
Update Adobe Animate 2023 to version 23.0.16 or later, or Adobe Animate 2024 to version 24.0.14 or later. Apply updates through the Creative Cloud desktop application, or deploy the fixed versions through Adobe Admin Console in managed environments.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.