{"id":"CVE-2026-110091","kind":"vulnerability","aliases":["CVE-2026-110091"],"related":[],"title":"Adobe Premiere: missing authentication allows arbitrary file system write (local)","description":"Premiere Pro is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.","summary":"Adobe Premiere Pro has a missing authentication check on a critical function. An attacker can bypass a security feature and gain unauthorized write access, with no user interaction needed.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Premiere Pro","fixed":["26.5.3","27.0"],"affected":"<= 26.5.2, <= 25.6.6","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe","desktop","macos","premiere-pro","vendor","windows"],"not_affected_if":[],"how_to_check":"In Premiere, Help > About: affected if version is 26.5.2 or earlier (26.x line) or 25.6.6 or earlier (25.x line), on Windows or macOS. Creative Cloud desktop app also lists the installed version.","fix":"Update Adobe Premiere to 27.0, or to 26.5.3 if staying on the 26.x line, via Creative Cloud desktop app or Download Center. Adobe priority 3.","status":"open","published_at":"2026-11-10T21:18:20+00:00","first_seen_at":"2026-11-10T21:46:09+00:00","triaged_at":"2026-11-10T21:48:27+00:00","updated_at":"2026-11-10T22:01:21+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-10T21:48:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Adobe Premiere Pro: missing authentication lets attackers bypass security and write","impact":"medium","summary":"Adobe Premiere Pro has a missing authentication check on a critical function. An attacker can bypass a security feature and gain unauthorized write access, with no user interaction needed.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["premiere-pro","adobe","desktop"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker bypasses security features and gains unauthorized write access","analyst_note":"Check Adobe's security bulletin for affected and fixed Premiere Pro versions, and whether a local or network attacker is needed.","how_to_check":"unknown","plain_action":"","product_name":"Premiere Pro","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Affected installs of Adobe Premiere Pro. The sources do not name the affected versions or the conditions needed beyond the flaw itself, so whether a given install is exposed is unknown.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000678,"input_tokens":4550,"output_tokens":445,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Adobe's security bulletin for affected and fixed Premiere Pro versions, and whether a local or network attacker is needed.","search":"'-110091':13A,16A '-2026':12A,15A 'access':50B,90C 'adob':1A,19B,27B 'affect':59C 'allow':5A 'arbitrari':6A 'attack':40B,77C 'authent':4A,33B,63C 'bypass':42B,75C,83C 'chang':102C 'check':34B 'could':69C,78C 'critic':37B,65C 'cve':11A,14A 'desktop':20B 'exploit':91C 'featur':45B,74C 'file':7A 'function':38B,66C 'gain':47B,87C 'interact':54B,99C 'issu':94C 'leverag':79C 'local':10A 'maco':21B 'measur':85C 'miss':3A,32B,62C 'need':55B 'premier':2A,23B,28B,56C 'premiere':17A 'premiere-pro':22B 'pro':18A,24B,29B,57C 'requir':97C 'result':70C 'scope':100C 'secur':44B,73C,84C 'system':8A 'unauthor':48B,88C 'user':53B,98C 'vendor':25B 'vulner':67C,81C 'window':26B 'write':9A,49B,89C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe Premiere 26.5.2 or earlier, or 25.6.6 or earlier, on Windows or macOS. Adobe's CVSS vector is local (AV:L), no privileges or user interaction, and impact is arbitrary file system write with changed scope. Mostly matters on shared or managed editing workstations; teams with no Premiere installs can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:01:21Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2906},"products":{"at":"2026-11-10T22:01:21Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2906},"how_to_check":{"at":"2026-11-10T22:01:21Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2906},"who_affected":{"at":"2026-11-10T22:01:21Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","run_id":2906}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["premierepro","pro"],"ptokens":["premiere","pro"],"labels":["adobe","desktop","high","macos","premierepro","vendor","windows"],"campaign_type":null,"search_a":"'-110091':13A,16A '-2026':12A,15A 'adob':1A 'allow':5A 'arbitrari':6A 'authent':4A 'cve':11A,14A 'file':7A 'local':10A 'miss':3A 'premier':2A 'premiere':17A 'pro':18A 'system':8A 'write':9A","search_b":"'access':50B 'adob':19B,27B 'attack':40B 'authent':33B 'bypass':42B 'check':34B 'critic':37B 'desktop':20B 'featur':45B 'function':38B 'gain':47B 'interact':54B 'maco':21B 'miss':32B 'need':55B 'premier':23B,28B 'premiere-pro':22B 'pro':24B,29B 'secur':44B 'unauthor':48B 'user':53B 'vendor':25B 'window':26B 'write':49B","search_c":"'access':90C 'affect':59C 'attack':77C 'authent':63C 'bypass':75C,83C 'chang':102C 'could':69C,78C 'critic':65C 'exploit':91C 'featur':74C 'function':66C 'gain':87C 'interact':99C 'issu':94C 'leverag':79C 'measur':85C 'miss':62C 'premier':56C 'pro':57C 'requir':97C 'result':70C 'scope':100C 'secur':73C,84C 'unauthor':88C 'user':98C 'vulner':67C,81C 'write':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110091","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110091","severity":null,"published_at":"2026-11-10T21:18:20+00:00","modified_at":"2026-11-10T21:18:20+00:00","first_seen_at":"2026-11-10T21:46:09+00:00","fetched_at":"2026-11-10T21:46:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110091:2906","url":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","severity":null,"published_at":"2026-11-10T22:01:21+00:00","modified_at":"2026-11-10T22:01:21+00:00","first_seen_at":"2026-11-10T22:01:21+00:00","fetched_at":"2026-11-10T22:01:21+00:00","note":"Read Adobe APSB26-101 (Nov 10 2026): affected, fixed versions, local vector, no known exploitation.","cites":["https://www.adobe.com/trust/security/products/premiere/apsb26-101.html"]}],"documents":[{"id":119283,"url":"https://www.adobe.com/trust/security/products/premiere/apsb26-101.html","title":"Adobe Premiere APSB26-101","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}