Adobe Bridge and Photoshop: 9 Flaws Fixed, CVE-2026-48395 the Worst

Adobe has disclosed eight vulnerabilities in Adobe Bridge, the software creative teams use to sort and review image assets, plus one in the Adobe Photoshop installer — nine in total. All nine landed in the US National Vulnerability Database (NVD) on July 28, 2026. The heaviest of them is CVE-2026-48395, rated 8.6 out of 10.

Let us clear up the most common misreading first. This is not the kind of flaw where someone takes over your machine from across the internet while you do nothing. Every one of the eight Bridge issues requires that the victim opens a malicious file themselves. Adobe's own CVE records spell it out for eight of the nine: "Exploitation of this issue requires user interaction in that a victim must open a malicious file." The scoring reflects that too — the attack originates locally (AV:L) and user interaction is required (UI:R).

But stopping there would be a mistake. Bridge exists precisely so that you can open files other people sent you and look at them. RAW files from a photographer, proofs back from the printer, assets forwarded by an agency — opening and triaging those files all day is what Bridge is for. Which means the precondition "the victim opens a malicious file" overlaps almost perfectly with the daily routine of a production studio. A flaw being conditional and a flaw's conditions being hard to meet are two completely different things.

What the nine issues actually are

Here is the whole set. The eight Bridge issues are collected in Adobe's security bulletin APSB26-89; the single Photoshop issue is handled separately. The severity figures are the CVSS v3.1 base scores in NVD, all of them calculated by Adobe itself.

Do not blur the counts together. Eight belong to Bridge, one belongs to the Photoshop installer. The two are different in nature, so they get separate sections below.

Studios that open asset files all day are the ones picked out by name

Nobody exploits this by scanning the internet for random victims. The people who would use these holes aim at photo studios, design agencies, print shops and advertising production houses — workplaces that open externally supplied asset files every single day. Staff names and job functions are public on business cards and social media, and an email that says "here are the images" raises no eyebrows at all. Slipping in one file that gets opened in Bridge is not a hard piece of work against a target like that. The same shape applies when a production partner is used as a stepping stone into the large client that hired them.

One folder of assets, one image tucked inside it — that is the entire toolkit. Hand over a malformed image or a doctored folder of assets, and let their own code start the moment it is opened in Bridge. That code inherits whatever rights the person who opened the file already had. No administrator account is needed. A designer's own account is enough to read the shared asset folders on the server, drive the company chat client, and reach the places where credentials get stored.

Unreleased campaign visuals, new product packaging, talent photo shoots. For a production house those are the painful losses — assets that turn into contract disputes the moment they leak early — and what stands to be lost takes the shape of the industry. For the client that commissioned the work, their own unreleased material walks out through a partner. And if the intruder moves sideways into the corporate network, the story does not end with leaked artwork. So "we are too small to be a target" is not a way out of these nine; getting the update described below done the same day is.

How this differs from a flaw that needs no conditions at all

Severity is scored with a shared formula called CVSS. Reading the breakdown tells you whether a hole gets attacked on its own or waits for a human to act. All nine here are the waiting kind.

The vector for the heaviest one, CVE-2026-48395, is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. The leading AV:L means the attack starts on the machine itself rather than over the network, and UI:R means user interaction is required. Compare that with another Adobe product: the ColdFusion flaws that came under active attack in July were AV:N with PR:N/UI:N — over the network, no login, no clicking — and scored a perfect 10. Putting Bridge in the same urgency bucket as an internet-facing appliance like Citrix NetScaler or a WordPress plugin that can be taken over without logging in would not be accurate.

That said, part of the breakdown deserves attention. Five of the nine (CVE-2026-48395, 48396, 48390, 48391 and 48388) carry S:C, meaning Adobe itself judges that the impact does not stay inside the application. This is not one piece of software misbehaving; it reaches other parts of the machine. That judgement is why scores of 8.6 and 8.2 look high for issues that need a click.

There is exactly one inconsistency in the wording. Of the eight Bridge issues, only CVE-2026-48391 mentions "a low-privileged attacker," and its breakdown reads PR:L — some level of access is needed. The other seven read PR:N. That single character is what separates CVE-2026-48395 at 8.6 from CVE-2026-48391 at 8.2, both classified as untrusted search path issues. Adobe's descriptions do not reveal what differs technically.

That post concerns Adobe ColdFusion in the same month, where attacks were actually observed. For the nine Bridge and Photoshop issues, no such exploitation reports had surfaced as of this writing.

The eight Bridge issues, one at a time

Adobe's descriptions are all short, so what follows separates what is known from what is not. Everything below comes from NVD and the CVE records Adobe filed.

CVE-2026-48395: Untrusted search path (8.6)

The heaviest of the nine. Programs load external components (libraries) while running, and if the list of places they search includes somewhere untrustworthy, a fake component planted by an attacker gets loaded first. The result is arbitrary code running with the rights of the logged-in user. Classified as CWE-426 (Untrusted Search Path). Opening a malicious file is required (NVD).

CVE-2026-48396: Incorrect authorization (8.6)

The check for "is this party allowed to do this?" is not performed correctly (CWE-863: Incorrect Authorization). An operation that should have been refused goes through, and arbitrary code runs with the logged-in user's rights. Same 8.6 score as 48395, and the same out-of-application impact rating (S:C) (NVD).

CVE-2026-48390: Incorrect authorization leading to privilege escalation (8.2)

Same CWE-863 as 48396, but the stated outcome is privilege escalation. In Adobe's wording, an attacker gains unauthorized read and write access. It is the flavour of damage where files get corrupted or rewritten; availability impact is rated as none, which is why it lands at 8.2 rather than higher (NVD).

CVE-2026-48391: Arbitrary code execution by a low-privileged attacker (8.2)

Same CWE-426 as 48395, but the only one of the eight whose description says a low-privileged attacker can exploit it. The breakdown reads PR:L, so the attacker needs some level of access. On a shared workstation, or anywhere several people take turns on the same account, that condition is not much of an obstacle (NVD).

CVE-2026-48374: Path traversal exposing files (7.8)

Mixing "go up a level" notation into a filename lets an attacker read files from places that should be off limits (CWE-22). Adobe says sensitive files and directories outside the intended access scope can be reached. This one does not run code — the damage is that things get read (NVD).

CVE-2026-48392: Out-of-bounds write (7.8)

The program writes past the end of the memory it reserved (CWE-787: Out-of-bounds Write). Feed it a malformed image, steer the overflow onto a chosen spot, and arbitrary code runs. This is a pattern that has been turning up in image-handling software for decades (NVD).

CVE-2026-48393: Out-of-bounds write (7.8)

Filed with exactly the same description, the same score and the same vector as 48392. Adobe has not published what differs between the two locations (NVD).

CVE-2026-48394: Out-of-bounds write (7.8)

Identical wording again. All the public information supports is the plain fact that three issues of the same class were filed together; whether they sit in different spots of the same routine or in separate features cannot be determined. Adobe has not named a finder either — the CVE records only note that discovery was external (NVD).

The Photoshop issue is an installer problem, and it behaves differently

The remaining issue, CVE-2026-48388, is not in Photoshop itself. It is in the installer that puts Photoshop on the machine. It should not be counted in with the eight Bridge issues, so here it stands on its own.

CVE-2026-48388: Uncontrolled search path element in the Photoshop installer (8.6)

The installer loads components (libraries) while it runs, and the set of places it searched was not tightly enough constrained (CWE-427: Uncontrolled Search Path Element). If an attacker has already placed a doctored component in one of those folders, the installer loads it and executes arbitrary code. The score is 8.6, with the same out-of-application impact rating (S:C).

The conditions differ sharply from the Bridge eight. It only works while the installer is actually running. On top of that, the attacker must already be able to write into a folder the installer searches. In practice the risky settings are shared computers used by several people, shared folders with loose write permissions, and machines where an intruder is already present and a legitimate Photoshop install happens afterwards. If Photoshop is already installed and no reinstall is planned, this one has no opening.

The public record for this issue reads differently from the other eight as well. Adobe's description is written entirely in the past tense ("was affected," "could have resulted"), filed as something already dealt with. The affected-version field is filled in only as "0 and up," with the upper bound left as N/A. In other words, Adobe does not say which installer versions are affected or which one is safe. The references do not point to an Adobe bulletin either — only to the CWE page and the CVE.org record. Since there is no version to upgrade to, the only visible step for anyone about to install Photoshop is to pull a current installer through the Creative Cloud desktop app.

Which versions are affected, and what to upgrade to

For the eight Bridge issues, the CVE records Adobe filed state the affected range and the fixed release. The values are identical across all eight.

The 15.x line is the branch Adobe maintains as long-term support. Teams with projects that cannot move to 16.x still have 15.1.7 as an escape route. Note that 16.0.6 was announced on Adobe's community site on July 22, 2026, so the rollout began before the CVEs became public on July 28. Anyone who already took that update may already be clear of all eight.

Adobe's priority rating (Priority 1/2/3) and severity label (Critical / Important) could not be confirmed at the time of writing. The bulletin page on helpx.adobe.com would not return its body text, and no archived copy exists. For reference, the previous Bridge bulletin published on July 14 (APSB26-81, six issues) was rated Critical with priority 3 — update recommended, timing at your discretion — according to Japanese outlet Mado no Mori. Whether the eight new issues carry the same rating needs checking on Adobe's page directly.

How to run the update from Creative Cloud

Most people reading this are not IT administrators — they are the ones using Bridge every day. So here is where to click.

Open the Creative Cloud desktop app from the Creative Cloud icon in the Windows system tray or the macOS menu bar. Pick "Updates" in the left-hand menu, and a list of apps with available updates appears. If there is an Update button on the Bridge row, pressing it is the whole job. Adobe's own community announcement gives the same instruction: click Update next to Bridge in the Creative Cloud desktop app.

Sometimes the update is not in the list. Adobe states that 16.0.6 is being rolled out incrementally, so it may not have reached your machine yet. In that case, re-run the update check from the menu at the top right, and if it still does not appear, wait a while and try again. Adobe's guidance is to wait until the public update reaches all users.

To see which build you are on, launch Bridge and open the "About Adobe Bridge" panel. Anything at 16.0.5 or below, or 15.1.6 or below, is affected. If you manage dozens of machines, listing versions from the Creative Cloud team admin console and picking out the ones short of 16.0.6 or 15.1.7 will be faster. Exact steps vary by OS and plan, so check the Adobe Bridge release notes alongside this.

Is any of this being exploited yet

Short answer: nothing in the public record suggests exploitation. Three indicators were checked.

First, EPSS — the estimated probability that a flaw gets exploited in the next 30 days. Querying all nine against FIRST's EPSS returned no score for any of them as of July 29, 2026. That is expected one day after publication; numbers should appear within days.

Second, CISA KEV — the US agency's list of flaws confirmed to be under active attack. The July 27, 2026 catalog (1,655 entries) contains none of the nine. Adobe products account for 80 entries historically, but Bridge appears in none of them. How to read and use KEV is covered in our CISA KEV dashboard write-up.

Third, proof-of-concept code and observed attacks. No published exploit code or vendor telemetry reports were found for any of the nine. Adobe said of its July 14 monthly release that it was not aware of exploits for any of the issues addressed; whether the same statement accompanies these eight could not be verified, because the Adobe page would not load.

That post is about the July 14 monthly release (12 products, 88 to 89 issues), which is a separate event from these nine. In Zero Day Initiative's July review, Bridge is recorded as APSB26-81 with six issues. Separately from that, Bridge 16.0.6 shipped on July 22 and the eight issues in APSB26-89 went public on July 28. Stack.watch's Adobe Bridge listing shows all eight dated July 28 under APSB26-89.

Has Japan issued any advisory or coverage

Adobe issues tend to get picked up by Japanese media, so the national registries were checked. Results as of July 29, 2026.

JVN iPedia, the Japanese vulnerability database run by IPA and JPCERT/CC, returned "no matching vulnerability information" when queried through the MyJVN API for Adobe entries published on or after July 20. None of the nine has a Japanese-language entry yet.

The JPCERT/CC alert index for 2026 lists only Acrobat and Reader among Adobe products (APSB26-26, 26-43, 26-44 and 26-63), and its sole July item concerns Microsoft's monthly updates. There is no alert for Bridge or Photoshop. IPA's urgent advisory page has nothing either.

On the media side, Mado no Mori covered the monthly release (12 products, 89 issues) on July 15. But the Bridge content there is APSB26-81's six issues; no Japanese-language article covering the eight issues published on July 28 could be found, including through Hatena Bookmark search. As far as we can tell, this is the first write-up in Japanese to cover all nine together. Put the other way round: waiting for the national registries will delay your update. Decide from Adobe's own records.

What Adobe disclosed, and what it held back

What to finish today, before you open the next asset

If you use Bridge, open the Creative Cloud desktop app and move to 16.0.6 (or 15.1.7). That closes all eight. It takes a few minutes, and the only preparation is saving and closing whatever you have open. Machines where the update has not appeared yet are simply mid-rollout; for those few days, raising your guard by one notch when opening asset files is the realistic answer.

For organisations, the ordering goes like this. Holes that anyone can attack across the network, such as the ColdFusion ones, come first, and Bridge comes after. But "after" is not "skip." Machines in a production department exist to open files that arrived from outside, which makes them exactly where conditional vulnerabilities bite hardest. On how to read conditional vulnerabilities, the practical test is not the severity number but whether the condition is met routinely in your own workplace.

The single Photoshop installer issue only matters if a fresh installation is coming up. Avoid installing on shared computers or in environments with loose permissions, and use an installer pulled from the Creative Cloud desktop app.

One day after publication, these nine have no exploitation reports and no EPSS figures. There is no reason to panic — and equally, with the Bridge fix already shipping since July 22, no reason to put off a job that amounts to pressing one button.

Sources

• ▸ Adobe - Security update available for Adobe Bridge | APSB26-89 (July 28, 2026; official bulletin for the eight Bridge issues)
• ▸ NVD - CVE-2026-48395 (8.6, untrusted search path)
• ▸ NVD - CVE-2026-48396 (8.6, incorrect authorization)
• ▸ NVD - CVE-2026-48390 (8.2, privilege escalation)
• ▸ NVD - CVE-2026-48391 (8.2, low-privileged attacker)
• ▸ NVD - CVE-2026-48374 (7.8, path traversal)
• ▸ NVD - CVE-2026-48392 (7.8, out-of-bounds write)
• ▸ NVD - CVE-2026-48393 (7.8, out-of-bounds write)
• ▸ NVD - CVE-2026-48394 (7.8, out-of-bounds write)
• ▸ NVD - CVE-2026-48388 (8.6, Photoshop installer)
• ▸ CVE.org - CVE-2026-48388 record (confirming the N/A affected version)
• ▸ Adobe Community - Adobe Bridge 16.0.6 is now available (July 22, 2026; update steps and incremental rollout)
• ▸ Adobe - Adobe Bridge release notes
• ▸ Zero Day Initiative - The July 2026 Security Update Review (July 14 monthly release; Bridge as APSB26-81 with six issues)
• ▸ Mado no Mori - Adobe's July 2026 security updates (July 15, 2026; severity and priority of APSB26-81)
• ▸ stack.watch - Adobe Bridge Security Vulnerabilities (confirming the eight issues under APSB26-89)
• ▸ CISA - Known Exploited Vulnerabilities Catalog (July 27, 2026 catalog, 1,655 entries)
• ▸ FIRST - EPSS (no scores for any of the nine)
• ▸ JVN iPedia (checked via the MyJVN API; not registered)
• ▸ JPCERT/CC - 2026 alert index (no alert for Bridge or Photoshop)
• ▸ IPA - FY2026 urgent advisories