CVE-2026-75990: Incorrect Authorization (CWE-863) in Adobe Illustrator Desktop 2026

CVE-2026-75990 is an Incorrect Authorization vulnerability in Adobe Illustrator Desktop 2026 that enables arbitrary code execution in the context of the current user. The vulnerability requires user interaction, as the victim must open a malicious file to trigger exploitation. The vulnerability affects versions up to 30.7 and 29.8.10. The CVSS v3.1 score is 8.6, reflecting high severity with attack vector local, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the current user, potentially leading to full compromise of the user's environment. The requirement for user interaction limits exploitation to scenarios where the user opens a crafted malicious file. The changed scope indicates that the impact extends beyond the initially vulnerable component, possibly affecting other parts of the system or application.

No patch or official fix information is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when opening files from untrusted sources and follow Adobe's security recommendations.