Vulnerability-Lookup

CVE-2026-81997 (GCVE-0-2026-81997)

Vulnerability from cvelistv5 – Published: 2026-09-08 20:30 – Updated: 2026-09-09 13:30

Title

Acrobat Reader | Incorrect Authorization (CWE-863)

Summary

Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-09 13:30 UTC

CWE

CWE-863 - Incorrect Authorization (CWE-863)

Assigner

adobe mitre root

References

1 reference

URL	Tags
https://helpx.adobe.com/security/products/acrobat…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version	CPE status
Adobe	Adobe Acrobat	Affected: 0 , ≤ 26.002.21900 (custom) Unaffected: 26.002.21901 (custom)	guessed
Adobe	Acrobat Reader	Affected: 0 , ≤ 26.002.21900 (custom) Unaffected: 26.002.21901 (custom)	guessed
Adobe	Acrobat 2024	Affected: 0 , ≤ 24.001.30383 (custom) Unaffected: 24.001.30429 (custom)	guessed

Date Public

2026-09-08 17:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81997",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T13:30:09.970692Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T13:30:23.918Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Adobe Acrobat",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "26.002.21900",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.002.21901",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Acrobat Reader",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "26.002.21900",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.002.21901",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Acrobat 2024",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "24.001.30383",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "24.001.30429",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-09-08T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 6.3,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "HIGH",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "LOCAL",
            "modifiedAvailabilityImpact": "NONE",
            "modifiedConfidentialityImpact": "NONE",
            "modifiedIntegrityImpact": "HIGH",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "CHANGED",
            "modifiedUserInteraction": "REQUIRED",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "CHANGED",
            "temporalScore": 6.3,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization (CWE-863)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T20:30:57.252Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://helpx.adobe.com/security/products/acrobat/apsb26-141.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Acrobat Reader | Incorrect Authorization (CWE-863)",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2026-81997",
    "datePublished": "2026-09-08T20:30:57.252Z",
    "dateReserved": "2026-08-27T21:20:45.366Z",
    "dateUpdated": "2026-09-09T13:30:23.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-81997",
      "date": "2026-09-21",
      "epss": "0.00152",
      "percentile": "0.04704"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Adobe Acrobat",
                "vendor": "Adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "26.002.21900",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  },
                  {
                    "status": "unaffected",
                    "version": "26.002.21901",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Acrobat Reader",
                "vendor": "Adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "26.002.21900",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  },
                  {
                    "status": "unaffected",
                    "version": "26.002.21901",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Acrobat 2024",
                "vendor": "Adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "24.001.30383",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  },
                  {
                    "status": "unaffected",
                    "version": "24.001.30429",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "psirt@adobe.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*",
                    "matchCriteriaId": "0638C53B-2AE7-4415-81CC-4685868008D1",
                    "versionEndExcluding": "24.001.30429",
                    "versionStartIncluding": "24.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*",
                    "matchCriteriaId": "B9192F4D-A119-46C4-A167-F500ACB3ACAB",
                    "versionEndExcluding": "26.002.21901",
                    "versionStartIncluding": "15.008.20082",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*",
                    "matchCriteriaId": "2FEAAE8A-F164-4DCA-8F08-9BC646831744",
                    "versionEndExcluding": "26.002.21901",
                    "versionStartIncluding": "15.008.20082",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."
          }
        ],
        "id": "CVE-2026-81997",
        "lastModified": "2026-09-10T16:28:21.750",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 4.0,
              "source": "psirt@adobe.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-81997",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T13:30:09.970692Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-08T21:18:46.493",
        "references": [
          {
            "source": "psirt@adobe.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://helpx.adobe.com/security/products/acrobat/apsb26-141.html"
          }
        ],
        "sourceIdentifier": "psirt@adobe.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-863"
              }
            ],
            "source": "psirt@adobe.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-81997",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-09T13:30:09.970692Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-09T13:30:18.761Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Adobe Acrobat",
              "vendor": "Adobe",
              "versions": [
                {
                  "lessThanOrEqual": "26.002.21900",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                },
                {
                  "status": "unaffected",
                  "version": "26.002.21901",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Acrobat Reader",
              "vendor": "Adobe",
              "versions": [
                {
                  "lessThanOrEqual": "26.002.21900",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                },
                {
                  "status": "unaffected",
                  "version": "26.002.21901",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Acrobat 2024",
              "vendor": "Adobe",
              "versions": [
                {
                  "lessThanOrEqual": "24.001.30383",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                },
                {
                  "status": "unaffected",
                  "version": "24.001.30429",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "datePublic": "2026-09-08T17:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "confidentialityRequirement": "NOT_DEFINED",
                "environmentalScore": 6.3,
                "environmentalSeverity": "MEDIUM",
                "exploitCodeMaturity": "NOT_DEFINED",
                "integrityImpact": "HIGH",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "LOW",
                "modifiedAttackVector": "LOCAL",
                "modifiedAvailabilityImpact": "NONE",
                "modifiedConfidentialityImpact": "NONE",
                "modifiedIntegrityImpact": "HIGH",
                "modifiedPrivilegesRequired": "NONE",
                "modifiedScope": "CHANGED",
                "modifiedUserInteraction": "REQUIRED",
                "privilegesRequired": "NONE",
                "remediationLevel": "NOT_DEFINED",
                "reportConfidence": "NOT_DEFINED",
                "scope": "CHANGED",
                "temporalScore": 6.3,
                "temporalSeverity": "MEDIUM",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "Incorrect Authorization (CWE-863)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-08T20:30:57.252Z",
            "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
            "shortName": "adobe"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://helpx.adobe.com/security/products/acrobat/apsb26-141.html"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Acrobat Reader | Incorrect Authorization (CWE-863)",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "assignerShortName": "adobe",
        "cveId": "CVE-2026-81997",
        "datePublished": "2026-09-08T20:30:57.252Z",
        "dateReserved": "2026-08-27T21:20:45.366Z",
        "dateUpdated": "2026-09-08T20:30:57.252Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-1140

Vulnerability from certfr_avis - Published: 2026-09-09 - Updated: 2026-09-09

De multiples vulnérabilités ont été découvertes dans les produits Adobe. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Adobe	Commerce	Adobe Commerce versions antérieures à 2.4.4-2026-sep
Adobe	Commerce	Adobe Commerce versions 2.4.5-x antérieures à 2.4.5-2026-sep
Adobe	Commerce B2B	Adobe Commerce B2B versions 1.4.x antérieures à 1.4.2-2026-sep
Adobe	Magento	Magento Open Source versions 2.4.9-x antérieures à 2.4.9-2026-sep
Adobe	ColdFusion	ColdFusion 2025 versions antérieures à 2025.0.13
Adobe	Acrobat	Acrobat 2024 versions antérieures à 24.001.30429 pour Windows et macOS
Adobe	Commerce	Adobe Commerce versions 2.4.9-x antérieures à 2.4.9-2026-sep
Adobe	Commerce	Adobe Commerce versions 2.4.6-x antérieures à 2.4.6-2026-sep
Adobe	Magento	Magento Open Source versions 2.4.8-x antérieures à 2.4.8-2026-sep
Adobe	Magento	Magento Open Source versions antérieures à 2.4.7-2026-sep
Adobe	Commerce B2B	Adobe Commerce B2B versions 1.3.4-x antérieures à 1.3.4-2026-sep
Adobe	Commerce	Adobe Commerce versions 2.4.7-x antérieures à 2.4.7-2026-sep
Adobe	Commerce B2B	Adobe Commerce B2B versions 1.5.3-x antérieures à 1.5.3-2026-sep
Adobe	Commerce B2B	Adobe Commerce B2B versions 1.5.2-x antérieures à 1.5.2-2026-sep
Adobe	Commerce B2B	Adobe Commerce B2B versions antérieures à 1.3.3-2026-sep
Adobe	Commerce	Adobe Commerce versions 2.4.8-x antérieures à 2.4.8-2026-sep
Adobe	Acrobat	Adobe Acrobat versions antérieures à 26.002.21901 pour Windows et macOS
Adobe	Acrobat	Acrobat Reader versions antérieures à 26.002.21901 pour Windows et macOS
Adobe	ColdFusion	ColdFusion 2023 versions antérieures à 2023.0.24

References

Title

Publication Time

Tags

Bulletin de sécurité Adobe APSB26-119	2026-09-08	vendor-advisory
Bulletin de sécurité Adobe APSB26-138	2026-09-08	vendor-advisory
Bulletin de sécurité Adobe APSB26-141	2026-09-08	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Adobe Commerce versions ant\u00e9rieures \u00e0 2.4.4-2026-sep",
      "product": {
        "name": "Commerce",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Commerce versions 2.4.5-x ant\u00e9rieures \u00e0 2.4.5-2026-sep",
      "product": {
        "name": "Commerce",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Commerce B2B versions 1.4.x ant\u00e9rieures \u00e0 1.4.2-2026-sep",
      "product": {
        "name": "Commerce B2B",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Magento Open Source versions 2.4.9-x ant\u00e9rieures \u00e0 2.4.9-2026-sep",
      "product": {
        "name": "Magento",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "ColdFusion 2025 versions ant\u00e9rieures \u00e0 2025.0.13",
      "product": {
        "name": "ColdFusion",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Acrobat 2024 versions ant\u00e9rieures \u00e0 24.001.30429 pour Windows et macOS",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Commerce versions 2.4.9-x ant\u00e9rieures \u00e0 2.4.9-2026-sep",
      "product": {
        "name": "Commerce",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Commerce versions 2.4.6-x ant\u00e9rieures \u00e0 2.4.6-2026-sep",
      "product": {
        "name": "Commerce",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Magento Open Source versions 2.4.8-x ant\u00e9rieures \u00e0 2.4.8-2026-sep",
      "product": {
        "name": "Magento",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Magento Open Source versions ant\u00e9rieures \u00e0 2.4.7-2026-sep",
      "product": {
        "name": "Magento",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Commerce B2B versions 1.3.4-x ant\u00e9rieures \u00e0 1.3.4-2026-sep",
      "product": {
        "name": "Commerce B2B",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Commerce versions 2.4.7-x ant\u00e9rieures \u00e0 2.4.7-2026-sep",
      "product": {
        "name": "Commerce",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Commerce B2B versions 1.5.3-x ant\u00e9rieures \u00e0 1.5.3-2026-sep",
      "product": {
        "name": "Commerce B2B",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Commerce B2B versions 1.5.2-x ant\u00e9rieures \u00e0 1.5.2-2026-sep",
      "product": {
        "name": "Commerce B2B",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Commerce B2B versions ant\u00e9rieures \u00e0 1.3.3-2026-sep",
      "product": {
        "name": "Commerce B2B",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Commerce versions 2.4.8-x ant\u00e9rieures \u00e0 2.4.8-2026-sep",
      "product": {
        "name": "Commerce",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Acrobat versions ant\u00e9rieures \u00e0 26.002.21901 pour Windows et macOS",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Acrobat Reader versions ant\u00e9rieures \u00e0 26.002.21901 pour Windows et macOS",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "ColdFusion 2023 versions ant\u00e9rieures \u00e0 2023.0.24",
      "product": {
        "name": "ColdFusion",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-82001",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-82001"
    },
    {
      "name": "CVE-2026-81990",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81990"
    },
    {
      "name": "CVE-2026-81982",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81982"
    },
    {
      "name": "CVE-2026-81984",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81984"
    },
    {
      "name": "CVE-2026-81989",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81989"
    },
    {
      "name": "CVE-2026-81988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81988"
    },
    {
      "name": "CVE-2026-77108",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77108"
    },
    {
      "name": "CVE-2026-76190",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76190"
    },
    {
      "name": "CVE-2026-81978",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81978"
    },
    {
      "name": "CVE-2026-81991",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81991"
    },
    {
      "name": "CVE-2026-81985",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81985"
    },
    {
      "name": "CVE-2026-81977",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81977"
    },
    {
      "name": "CVE-2026-80161",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-80161"
    },
    {
      "name": "CVE-2026-75999",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75999"
    },
    {
      "name": "CVE-2026-81973",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81973"
    },
    {
      "name": "CVE-2026-81986",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81986"
    },
    {
      "name": "CVE-2026-81975",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81975"
    },
    {
      "name": "CVE-2026-79907",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-79907"
    },
    {
      "name": "CVE-2026-81976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81976"
    },
    {
      "name": "CVE-2026-81994",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81994"
    },
    {
      "name": "CVE-2026-76201",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76201"
    },
    {
      "name": "CVE-2026-81980",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81980"
    },
    {
      "name": "CVE-2026-77111",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77111"
    },
    {
      "name": "CVE-2026-80160",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-80160"
    },
    {
      "name": "CVE-2026-77109",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77109"
    },
    {
      "name": "CVE-2026-81981",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81981"
    },
    {
      "name": "CVE-2026-81992",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81992"
    },
    {
      "name": "CVE-2026-79909",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-79909"
    },
    {
      "name": "CVE-2026-48273",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48273"
    },
    {
      "name": "CVE-2026-81983",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81983"
    },
    {
      "name": "CVE-2026-81997",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81997"
    },
    {
      "name": "CVE-2026-80162",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-80162"
    },
    {
      "name": "CVE-2026-76002",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76002"
    },
    {
      "name": "CVE-2026-76000",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76000"
    },
    {
      "name": "CVE-2026-76200",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76200"
    },
    {
      "name": "CVE-2026-79910",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-79910"
    },
    {
      "name": "CVE-2026-77774",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77774"
    },
    {
      "name": "CVE-2026-75746",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75746"
    },
    {
      "name": "CVE-2026-77110",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77110"
    },
    {
      "name": "CVE-2026-81993",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81993"
    },
    {
      "name": "CVE-2026-75993",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75993"
    },
    {
      "name": "CVE-2026-80159",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-80159"
    },
    {
      "name": "CVE-2026-81996",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81996"
    },
    {
      "name": "CVE-2026-81987",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81987"
    },
    {
      "name": "CVE-2026-79908",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-79908"
    },
    {
      "name": "CVE-2026-21269",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21269"
    },
    {
      "name": "CVE-2026-76202",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76202"
    },
    {
      "name": "CVE-2026-75998",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75998"
    },
    {
      "name": "CVE-2026-81979",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81979"
    }
  ],
  "initial_release_date": "2026-09-09T00:00:00",
  "last_revision_date": "2026-09-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1140",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-09-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Injection SQL (SQLi)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Adobe. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Adobe",
  "vendor_advisories": [
    {
      "published_at": "2026-09-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Adobe APSB26-119",
      "url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-119.html"
    },
    {
      "published_at": "2026-09-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Adobe APSB26-138",
      "url": "https://helpx.adobe.com/security/products/magento/apsb26-138.html"
    },
    {
      "published_at": "2026-09-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Adobe APSB26-141",
      "url": "https://helpx.adobe.com/security/products/acrobat/apsb26-141.html"
    }
  ]
}

FKIE_CVE-2026-81997

Vulnerability from fkie_nvd - Published: 2026-09-08 21:18 - Updated: 2026-09-10 16:28

Severity

6.3 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Summary

References

	URL	Tags
	psirt@adobe.com	https://helpx.adobe.com/security/products/acrobat/apsb26-141.html	Vendor Advisory

Impacted products

Vendor	Product	Version
adobe	acrobat	*
adobe	acrobat_dc	*
adobe	acrobat_reader_dc	*
apple	macos	-
microsoft	windows	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Adobe Acrobat",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "26.002.21900",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.002.21901",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Acrobat Reader",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "26.002.21900",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.002.21901",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Acrobat 2024",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "24.001.30383",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "24.001.30429",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "psirt@adobe.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*",
              "matchCriteriaId": "0638C53B-2AE7-4415-81CC-4685868008D1",
              "versionEndExcluding": "24.001.30429",
              "versionStartIncluding": "24.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*",
              "matchCriteriaId": "B9192F4D-A119-46C4-A167-F500ACB3ACAB",
              "versionEndExcluding": "26.002.21901",
              "versionStartIncluding": "15.008.20082",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*",
              "matchCriteriaId": "2FEAAE8A-F164-4DCA-8F08-9BC646831744",
              "versionEndExcluding": "26.002.21901",
              "versionStartIncluding": "15.008.20082",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."
    }
  ],
  "id": "CVE-2026-81997",
  "lastModified": "2026-09-10T16:28:21.750",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.0,
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-81997",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-09T13:30:09.970692Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-08T21:18:46.493",
  "references": [
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://helpx.adobe.com/security/products/acrobat/apsb26-141.html"
    }
  ],
  "sourceIdentifier": "psirt@adobe.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "psirt@adobe.com",
      "type": "Secondary"
    }
  ]
}

GHSA-QVXR-82R8-33CQ

Vulnerability from github – Published: 2026-09-08 21:34 – Updated: 2026-09-08 21:34

Details

Severity

6.3 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-81997"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-08T21:18:46Z",
    "severity": "MODERATE"
  },
  "details": "Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.",
  "id": "GHSA-qvxr-82r8-33cq",
  "modified": "2026-09-08T21:34:33Z",
  "published": "2026-09-08T21:34:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81997"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/acrobat/apsb26-141.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-81997 (GCVE-0-2026-81997)

CERTFR-2026-AVI-1140

Solutions

FKIE_CVE-2026-81997

GHSA-QVXR-82R8-33CQ

Tags

Sightings

Nomenclature

Related by attack behaviour