CVE-2026-48390

This vulnerability in Adobe Bridge carries a 'scope changed' designation that matters far more than the CVSS 8.2 score suggests. Scope changed means Bridge's authorization failure lets an attacker reach components outside Bridge's security boundary — most likely other Creative Cloud applications that share Bridge's file processing libraries or trust contexts. This isn't a Bridge-to-Bridge privilege problem; it's Bridge as an attack surface for the broader Adobe ecosystem. The 'user interaction required' precondition — that a user must open a malicious file — is technically accurate but dangerously incomplete for risk modeling. Professional creative workflows run heavily automated: batch processing scripts, watch folders, Bridge's own scripting API, and action pipelines all trigger file-handling code without per-file manual interaction. Your risk model should assume the exploitation surface includes automated ingestion, not just direct user file-opening. The critical insight is that this isn't an isolated flaw. Adobe has patched structurally identical vulnerabilities in Acrobat (CVE-2022-23203), Illustrator (CVE-2021-21007), and other CC components — each time addressing the specific vector while leaving the underlying architectural assumption intact: files are trusted inputs, and file-derived operations carry implicit authorization states. The pattern is documented and predictable. Bridge's patch will likely fix this specific authorization bypass, but the architectural assumption that files carry trust will persist, creating predictable recurrence windows in Bridge and adjacent applications. Immediate priorities: First, confirm your Bridge version against the patched release — this is a direct patch, not a cumulative security update, so only specific versions are remediated. Second, treat any automated file ingestion pipeline that feeds Bridge output to other CC applications as elevated-risk — audit watch folders, batch scripts, and integration points. Third, given the systemic pattern, expect similar CVEs in other Adobe CC applications within 12-18 months and factor that into your vulnerability prioritization. The EPSS score of 0.00144 reflects low automated exploitation today, but the CVSS architecture and historical pattern suggest this is a long-tail vulnerability that will see weaponized exploitation once reliable delivery vectors stabilize.

Reviewed through automated stages and approved by a human before publication.