Read the docs
TI-2024-22572 Aliases CVE-2024-34116GHSA-v865-6qv6-w5m2

Adobe Creative Cloud App Install Arbitrary Folder Delete Vulnerability can be abuse to Privilege Escalation

Priority LOW 31CWE-427Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
None · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-427.

Summary

Creative Cloud Desktop versions 6.1.0.587 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to load and execute malicious libraries, leading to arbitrary file delete. Exploitation of this issue requires user interaction.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00298 22nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AdobeCreative Cloud Desktopup to 6.1.0.587—No fix listedCNA
  • Creative Cloud Desktop VendorAdobe Affected up to 6.1.0.587 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:adobe:creative_cloud_desktop_application:*:*:*:*:*:*:*:*before 6.2.0.554VulnerableAdobe
  • cpe:2.3:a:adobe:creative_cloud_desktop_application:*:*:*:*:*:*:*:* Versions before 6.2.0.554 Vulnerable ·Adobe

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-34116
  2. 2026-10-03 Alias added: GHSA-v865-6qv6-w5m2

References

Patch 1

  • TI-2020-07769 Link following in Adobe Creative Cloud Desktop Application CVSS 3.1CRITICAL 9.8
  • TI-2020-07758 Incorrect permission assignment in Adobe Creative Cloud Desktop Application CVSS 3.1CRITICAL 9.8
  • TI-2020-07757 Link following in Adobe Creative Cloud Desktop Application CVSS 3.1CRITICAL 9.8
  • TI-2021-04175 Adobe Creative Cloud Privilege Escalation Vulnerability CVSS 3.0HIGH 7.8
  • TI-2021-19087 Adobe Creative Cloud Incorrect Permission Assignment Privilege Escalation Vulnerability CVSS 3.1HIGH 7.8
  • TI-2021-09666 Creative Cloud Desktop installer Uncontrolled Search Path element could lead to arbitrary code execution CVSS 3.1HIGH 7.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences