Adobe Dimension: Improper input neutralization (XSS) allows code execution
Summary
Adobe Dimension 4.1.8 and earlier on Windows and macOS is affected by CWE-79 (Cross-Site Scripting class), which Adobe classifies as arbitrary code execution. A local attacker can run code in the context of the current user, and the victim must run the application or open a crafted file. The CVSS base score is 8.6 (High) with changed scope. The exact weakness type should be confirmed in the Adobe advisory, as other entries in the same bulletin are described differently.
Affected
- Adobe Dimension 4.1.8 and earlier
- Windows and macOS
Fixed in
- Adobe Dimension 4.1.9 or later (Adobe priority 3)
Workaround
Unknown.
- No vendor-listed workaround found. Updating is the recommended fix.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in APSB26-171.
- CISA SSVC: exploitation none, not automatable.
- No public proof of concept found; this does not rule one out.
Our recommendation
- Inventory all Dimension installations on endpoints, including those not known to IT.
- Update to Adobe Dimension 4.1.9 or later via Creative Cloud.
- Restrict installation to users who need the product.
- Be cautious with project files and files from external sources until patched.
- Re-check the NVD entry and APSB26-171 for final CWE and CVSS details.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-171 www.adobe.com
- Tenable Nessus plugin 365770 www.tenable.com
- HKCERT Adobe monthly security update October 2026 www.hkcert.org
- Zero Day Initiative October 2026 security update review www.zerodayinitiative.com
- Adobe Dimension FAQ helpx.adobe.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:24.
Original description (NVD)
Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.