CVE-2026-21333
Published: 10 March 2026
Summary
CVE-2026-21333 is a high-severity Untrusted Search Path (CWE-426) vulnerability in Adobe Illustrator. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique DLL (T1574.001); ranked at the 5.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-21333 is an Untrusted Search Path vulnerability (CWE-426) affecting Adobe Illustrator versions 29.8.4, 30.1, and earlier. Published on 2026-03-10T23:16:43.400, the issue carries a CVSS v3.1 base score of 8.6 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). It might allow attackers to execute arbitrary code in the context of the current user upon opening a malicious file.
The attack requires local access with low complexity and no attacker privileges, but depends on user interaction as the victim must open a malicious file. Successful exploitation enables arbitrary code execution under the current user's context, with high impacts to confidentiality, integrity, and availability, amplified by a change in scope.
Adobe's security bulletin APSB26-18, available at https://helpx.adobe.com/security/products/illustrator/apsb26-18.html, details mitigations and patches for this vulnerability.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10940
Vulnerability details
Illustrator versions 29.8.4, 30.1 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. Exploitation of this issue requires user interaction in that a victim…
more
must open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Untrusted Search Path (CWE-426) directly enables DLL Search Order Hijacking / Side-Loading (T1038/T1574.002) upon user opening a malicious file (T1204.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the untrusted search path vulnerability by requiring timely patching of affected Adobe Illustrator versions as detailed in APSB26-18.
Enables scanning and identification of vulnerable Illustrator versions exposed to CVE-2026-21333 untrusted search path flaw.
Deploys malicious code protection to scan and block arbitrary code execution from malicious DLLs loaded via untrusted search paths when opening files.