High severity · published Nov 23, 2021
CVE-2021-43019
Adobe Creative Cloud version 5.5 (and earlier) are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service
7.8
CVSS
2.2%
EPSS
No
On KEV
Description
Adobe Creative Cloud version 5.5 (and earlier) are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service. An unauthenticated attacker could leverage this vulnerability to remove files and escalate privileges under the context of SYSTEM . An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability on the product installer. User interaction is required before product installation to abuse this vulnerability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
Affected product
CC
Creative Cloud Desktop Application
Adobe
More from Creative Cloud Desktop Application
9.8
CVE-2020-9682
Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a symlink vulnerability vulnerability
9.8
CVE-2020-9671
Adobe Creative Cloud Desktop Application versions 5.1 and earlier have an insecure file permissions vulnerability
9.8
CVE-2020-9670
Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a symlink vulnerability vulnerability
7.8
CVE-2026-48272
Creative Cloud Desktop | Uncontrolled Search Path Element (CWE-427)
7.8
CVE-2026-48344
GoCart | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)