CVE-2026-47906 is a vulnerability in Adobe Dreamweaver Desktop (versions 21.7 and earlier) caused by reliance on a vulnerable third-party component (CWE-1395). Successful exploitation requires the user to open a malicious file, enabling arbitrary code execution with the privileges of the current user. The vulnerability changes the security scope, indicating that the impact extends beyond the initial component. The CVSS v3.1 base score is 8.6 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting local attack vector, low attack complexity, no privileges required, user interaction required, changed scope, and high impact on confidentiality, integrity, and availability.

An attacker who convinces a user to open a crafted malicious file can execute arbitrary code within the context of the current user. This can lead to full compromise of the user's environment, including confidentiality, integrity, and availability impacts. The scope change indicates that the vulnerability affects components beyond the initially vulnerable third-party dependency.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published by Adobe at this time. Users should exercise caution when opening files from untrusted sources and monitor Adobe's security advisories for updates regarding a patch or mitigation.