# CVE-2026-48344: Adobe Creative Cloud Desktop TOCTOU race condition

Source: https://junglewise.ai/threats/cve-2026-48344-adobe-creative-cloud-desktop-toctou-race-condition  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-48344 · Severity: high · CVSS 7.8 · Published 2026-07-14

Adobe Creative Cloud Desktop, the management application for Adobe's suite of creative software, is affected by a security flaw that could allow an attacker to run unauthorized commands on a computer. If exploited, this could lead to a full system compromise or unauthorized access to user data. The attack requires the attacker to already have limited access to the machine and relies on specific timing conditions to succeed.

Technologies: [Adobe Creative Cloud Desktop](https://junglewise.ai/threats/technologies/creative-cloud-desktop). Vendors: [Adobe](https://junglewise.ai/threats/vendors/adobe).

## Quick answers

**Is CVE-2026-48344 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48344 being exploited in the wild.

**How severe is CVE-2026-48344?** High severity, with a CVSS score of 7.8, published 14 July 2026.

**Which products and versions are affected?** Adobe Creative Cloud Desktop <= 6.9.1.1.

**Is there a fix for CVE-2026-48344?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48344 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-48344?** Check whether you run Adobe Creative Cloud Desktop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Time-of-check Time-of-use (TOCTOU) race condition (CWE-367) exists in Adobe Creative Cloud Desktop versions 6.9.1.1 and earlier. An attacker with local low-privileged access can exploit a timing window between the application's validation of a resource and its subsequent use. Successful exploitation allows for arbitrary code execution with the privileges of the current user, and because the scope is changed (S:C), it may allow for escalation or impact beyond the immediate application environment. No user interaction is required, though the attack complexity is high due to the precise timing required for a successful race condition. The issue is resolved in version 6.10.0.252.3.

## Affected products

- Adobe Creative Cloud Desktop <= 6.9.1.1

## Timeline

- 2026-07-14: disclosed
- 2026-07-14: advisory

## References

- [https://helpx.adobe.com/security/products/creative-cloud/apsb26-77.html](https://helpx.adobe.com/security/products/creative-cloud/apsb26-77.html)

## Related threats

- [Adobe Creative Cloud Desktop uncontrolled search path element](https://junglewise.ai/threats/cve-2026-104349-creative-cloud-desktop-is-affected-by-an-uncontrolled-search)
- [Adobe Creative Cloud Desktop uncontrolled search path element](https://junglewise.ai/threats/cve-2026-48272-adobe-creative-cloud-desktop-uncontrolled-search-path-element)