Loading vulnerability…
Arbitrary Code Execution in Adobe Photoshop Desktop via Incorrect Authorization
CVE-2026-95639 is an incorrect authorization vulnerability in Adobe Photoshop Desktop affecting Photoshop 2025 versions 26.11.7 and earlier and Photoshop 2026 versions 27.10 and earlier on Windows and macOS. Opening a malicious file can trigger arbitrary code execution in the context of the current user. Exploitation requires user interaction and has changed security scope. The vulnerable function and underlying authorization-check details are not publicly specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution with the current user's permissions, potentially compromising the confidentiality, integrity, and availability of accessible data and resources. The CVSS assessment indicates high impacts across all three categories and changed scope; elevated operating-system privileges are not established.
If you can’t patch tonight, do this now.
Until updates are installed, avoid opening untrusted or unverified files in Photoshop. This is a precaution rather than a confirmed workaround; no vendor-approved workaround is specified.
Patch, then assume compromise.
Upgrade Photoshop 2025 to version 26.11.8 or later, or Photoshop 2026 to version 27.11 or later, as appropriate for the installed branch. These fixes were released under Adobe security bulletin APSB26-158 on October 13, 2026. Install updates through the Creative Cloud desktop app or deploy updated applications through the Adobe Admin Console for managed environments.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.