CVE-2026-21271
Published: 13 January 2026
Summary
CVE-2026-21271 is a high-severity Improper Input Validation (CWE-20) vulnerability in Adobe Dreamweaver. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 11.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-21271 is an Improper Input Validation vulnerability (CWE-20) affecting Adobe Dreamweaver Desktop versions 21.6 and earlier. Published on 2026-01-13, the issue carries a CVSS v3.1 base score of 8.6 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and enables arbitrary code execution in the context of the current user when a victim opens a malicious file, with the scope changed upon exploitation.
The attack requires local access (AV:L) and low complexity (AC:L), with no privileges needed from the attacker (PR:N), but relies on user interaction (UI:R) such as opening a crafted malicious file. Successful exploitation grants attackers high-impact control over confidentiality, integrity, and availability, allowing arbitrary code execution in an elevated scope.
Adobe's security bulletin APSB26-01, available at https://helpx.adobe.com/security/products/dreamweaver/apsb26-01.html, addresses the vulnerability and provides details on patches and mitigation steps.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2056
Vulnerability details
Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
more
open a malicious file and scope is changed.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in client application (Dreamweaver) directly enables RCE via user opening malicious file (T1204.002), matching Exploitation for Client Execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the vulnerability by requiring timely remediation through patching as specified in Adobe's APSB26-01 bulletin.
Addresses the core improper input validation (CWE-20) flaw by enforcing validation mechanisms at file input points in Dreamweaver.
Mitigates arbitrary code execution by protecting application memory from unauthorized code injection during malicious file processing.