CVE-2026-21267: 
Adobe Dreamweaver vulnerability analysis and mitigation

CVE-2026-21267 is an OS Command Injection vulnerability in Adobe Dreamweaver Desktop that allows arbitrary code execution when a victim opens a malicious file. It affects Dreamweaver Desktop versions 21.6 and earlier (all versions prior to 21.7) on both Windows and macOS platforms. The vulnerability was disclosed on January 13, 2026, with Adobe publishing the security advisory (APSB26-01) the same day. It carries a CVSS v3.1 base score of 8.6 (High), assigned by Adobe Systems Incorporated (Adobe Advisory, NVD).

The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning Dreamweaver Desktop fails to properly sanitize or neutralize special characters or sequences within OS commands when processing certain file types. An attacker can craft a malicious file that, when opened by a victim in Dreamweaver, causes the application to pass attacker-controlled input to an OS-level command interpreter without adequate validation. The attack vector is local (the file must be delivered and opened on the victim's machine), requires no privileges, but does require user interaction. Notably, the scope is marked as "Changed," indicating that successful exploitation can affect resources beyond the Dreamweaver application itself (Adobe Advisory, NVD).

Successful exploitation results in arbitrary code execution with the privileges of the Dreamweaver application process, with high impact to confidentiality, integrity, and availability. Because the scope is changed, the attacker's reach can extend beyond the Dreamweaver process to affect the broader system, potentially enabling data exfiltration, installation of malware, or further lateral movement within the victim's environment. Both Windows and macOS systems running affected versions are at risk (Adobe Advisory, NVD).

1. Craft a malicious file: An attacker creates a specially crafted file (e.g., a Dreamweaver project or supported document type) that embeds OS command injection payloads within fields or metadata processed by Dreamweaver's file-handling routines.
2. Deliver the file to the victim: The attacker distributes the malicious file via phishing email, a compromised website, or other social engineering methods, targeting users who have Dreamweaver Desktop installed.
3. Victim opens the file: The victim opens the malicious file in Adobe Dreamweaver Desktop (version 21.6 or earlier), triggering the vulnerable code path that processes the file's contents.
4. OS command injection executes: Dreamweaver passes unsanitized attacker-controlled input to an OS command, causing arbitrary commands to execute with the privileges of the Dreamweaver process on the victim's system.
5. Post-exploitation: The attacker's payload may establish persistence, exfiltrate sensitive data, or pivot to other systems accessible from the victim's machine (Adobe Advisory, NVD).

• Process: Unexpected child processes spawned by the Dreamweaver Desktop process (e.g., cmd.exe, powershell.exe, /bin/sh, /bin/bash, curl, wget) shortly after opening a file.
• File System: Presence of unexpected scripts, executables, or web shells created in user-writable directories following Dreamweaver usage; new scheduled tasks or cron jobs created by the Dreamweaver user account.
• Network: Unusual outbound network connections originating from the Dreamweaver process to unknown external IP addresses or domains, particularly after opening a file from an untrusted source.
• Logs: System or application logs showing OS command execution events associated with the Dreamweaver process; Windows Event Logs (Event ID 4688) or macOS Unified Logs recording unexpected process creation under the Dreamweaver parent process.

Adobe has released Dreamweaver Desktop version 21.7 to address this vulnerability; all users running version 21.6 or earlier should upgrade immediately (Adobe Advisory). As a workaround prior to patching, organizations should implement controls to restrict users from opening files received from untrusted or unknown sources, and educate users about the risks of opening unsolicited files. Security teams should deploy available detection signatures from Qualys (ID: 386328) and Tenable Nessus (IDs: 283673, 283674) to identify unpatched systems (Feedly).

The CIS (Center for Internet Security) published an advisory noting that multiple vulnerabilities in Adobe products, including this one, could allow for arbitrary code execution (CIS Advisory). The Zero Day Initiative covered the January 2026 Adobe security update in their monthly review (BeyondMachines). Social media commentary was limited, with brief mentions on Mastodon by security news accounts. Overall community reaction was measured, consistent with a high-severity but non-actively-exploited vulnerability requiring user interaction.