CVE-2026-84395

Executive Summary

CVE-2026-84395 is a Server-Side Request Forgery (SSRF) vulnerability in Adobe Premiere Pro that can result in privilege escalation and, per the NVD description, potentially unauthorized write access. The vector is local (AV:L) and requires no user interaction, with a changed scope (S:C), a high integrity impact, and no confidentiality or availability impact, yielding a CVSS 3.1 base score of 7.1. No public proof-of-concept, exploit code, Nuclei template, or vendor patch is currently available, and the CVE has not been scored by FIRST.org (EPSS) nor added to the CISA KEV catalog.

Technical Analysis

The vulnerability is classified as CWE-918: Server-Side Request Forgery. In an SSRF flaw, an attacker causes the affected application to issue a network request to a destination that the attacker controls or selects, rather than to a destination the application was intended to reach. The NVD description states that Premiere Pro "is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation potentially resulting in unauthorized write access." No further technical detail — such as the specific component, request handler, URL parameter, or code path involved — is provided in the CNA title or NVD description. Accordingly, this analysis confines itself to the vulnerability class and the mechanism implied by the CVSS vector; no function names, endpoints, file paths, or API parameters are asserted because none are available from the source data.

Key characteristics derivable from the supplied data:

• Attack vector (AV:L, local): The CVSS vector assigns a local attack vector. This indicates the attacker must already have some form of local access to the environment in which Premiere Pro operates — for example, a user session or a process able to influence the application — rather than being able to reach the vulnerable component directly over a network as an anonymous remote party. The absence of user interaction (UI:N) means the flaw can be triggered without tricking a human into performing an action.

• Privileges required (PR:N): No privileges are required, so the attacker does not need pre-existing elevated rights to trigger the flaw.

• Scope change (S:C): The scope is changed, meaning the exploitation of this vulnerability can affect resources beyond the security scope controlled by the vulnerable component. In the context of an SSRF leading to writes, this typically means the impact can cross a trust boundary — from Premiere Pro into a resource that the application can reach but that is outside its own security authority.

• Integrity-only impact (I:H, C:N, A:N): Only integrity is impacted, and it is rated High. There is no confidentiality or availability impact. Combined with the description's reference to "unauthorized write access," this indicates the principal risk is modification or creation of data — an attacker able to influence what the application writes or where it writes it — rather than data theft or denial of service.

• Attack complexity (AC:L): Low, meaning the flaw is exploitable without special conditions beyond those of the vector.

The precise trigger and the exact reachable resource for the outbound request are not disclosed. Because the affected-version data is empty, it cannot be determined from the supplied intelligence which Premiere Pro release trains are vulnerable. This is a significant intelligence gap for defenders.

Exploitation Scenarios

The following attack chain is constructed strictly from the vulnerability class (SSRF), the NVD description, and the CVSS vector. No public PoC or exploit code is available; the chain is inferred at the vulnerability-class level. No specific function names, endpoints, or parameters are asserted.

1. Reconnaissance / target identification. Because the vector is local (AV:L), the attacker must first establish a position with local access to an environment where Premiere Pro is running — for example, a user session on a workstation used for video editing, or code able to interact with the application. The attacker identifies that the target's Premiere Pro installation can be induced to make outbound requests to attacker-influenced destinations. No user interaction is required (UI:N), so the attacker does not depend on tricking the operator into a click or a dialog confirmation.

2. Triggering the SSRF. The attacker causes Premiere Pro to issue a server-side request to a destination of the attacker's choosing or influence. In an SSRF, this typically means supplying or manipulating a reference that the application resolves and fetches on its own behalf, so the request originates from the application's context rather than from the attacker directly. Because the specific input surface is not disclosed in the available data, the exact means of supplying that reference cannot be stated here.

3. Payload / execution method (vulnerability-class level). The request that the application makes on the attacker's behalf is the core of the exploit. Depending on the target of the request and the privileges of the Premiere Pro process, the response or the side effect of the request can cross a trust boundary (consistent with the changed scope, S:C). The description ties the outcome to "privilege escalation potentially resulting in unauthorized write access" — i.e., the attacker leverages the application's own request capability and any associated privilege to reach a resource that can be written to.

4. Post-exploitation impact. Per the CVSS vector, the demonstrated impact is High to integrity and none to confidentiality or availability: the attacker can effect unauthorized writes. The changed scope suggests the writes can affect resources outside Premiere Pro's own security context. No exfiltration or denial-of-service outcome is indicated by the vector.

Caveat: Because no affected versions, no component detail, and no PoC are available, this chain describes the class-level mechanism only. It must not be treated as a validated exploitation recipe.

Impact Assessment

The CVSS 3.1 base score for CVE-2026-84395 is 7.1 (High), with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. Subscore interpretation:

• AV:L (Local) and PR:N (None): The attacker needs local positioning but no prior privileges. This narrows the exposed population relative to a remotely exploitable flaw, but the absence of a privilege requirement means any local foothold may be sufficient to attempt exploitation.
• AC:L (Low) and UI:N (None): Exploitation is not gated by unusual conditions or by user interaction, which lowers the barrier for an attacker who has already obtained local access.
• S:C (Changed): Impact can propagate beyond the vulnerable component's security scope, meaning consequences may extend to other resources the affected application can reach.
• C:N / A:N / I:H: Impact is confined to integrity. The realistic worst case per the vector is unauthorized modification or creation of data — consistent with the description's mention of unauthorized write access — with no indicated loss of confidentiality or availability.

Affected systems: Adobe Premiere Pro installations. The vendor product name is provided in the description; no specific version range is available, so it is not possible to scope affected release trains from the supplied data.

Blast radius: Because the vector is local, the directly exploitable surface is constrained to hosts where an attacker has local access and where Premiere Pro is present. However, the changed scope and integrity impact mean that the consequence is not necessarily confined to the editing application itself — writes may reach resources outside Premiere Pro's own scope. In enterprise deployments where editing workstations are joined to corporate networks and have access to shared storage, media asset management systems, or other internal services, an SSRF-driven write could have a lateral footprint. No evidence of in-the-wild exploitation, weaponization, or KEV listing is available; the EPSS score has not been published by FIRST.org and must not be assumed.

Detection Guidance

Detection content below is necessarily heuristic. Because the specific request format, parameter, and destination of the SSRF are undisclosed, the rules target generic SSRF behavior — the Premiere Pro process making unexpected outbound requests — and should be tuned to the environment.

Sigma Rule

title: Potential Adobe Premiere Pro SSRF via Unexpected Outbound Connection
id: 9f1c6a2e-8439-5cve-a001-000000000000
status: experimental
description: Detects Adobe Premiere Pro process initiating outbound network connections,
  consistent with SSRF or unauthorized write activity (CVE-2026-84395).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84395
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\Adobe Premiere Pro.exe'
      - '\Adobe Premiere Pro 2024.exe'
      - '\Adobe Premiere Pro 2025.exe'
  selection_conn:
    Initiated: 'true'
  filter_trusted:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '192.168.0.0/16'
      - '172.16.0.0/12'
  condition: selection_image and selection_conn
falsepositives:
  - Legitimate Creative Cloud license checks and cloud sync
  - Adobe update service calls
level: medium
tags:
  - attack.t1190
  - cve.2026.84395

YARA Rule

rule CVE_2026_84395_PremierePro_SSRF_Indicator
{
    meta:
        description = "Heuristic indicator for Adobe Premiere Pro SSRF activity (CVE-2026-84395)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84395"
        severity = "medium"

    strings:
        $p1 = "Premiere Pro" ascii wide nocase
        $u1 = "http://" ascii nocase
        $u2 = "https://" ascii nocase
        $kw1 = "ssrf" ascii nocase
        $kw2 = "server-side request" ascii nocase

    condition:
        uint16(0) == 0x5A4D and
        filesize < 100MB and
        $p1 and
        ($u1 or $u2) and
        ($kw1 or $kw2)
}

Note: the YARA rule above is a heuristic file-scanning indicator only. No reliable byte-level signature for this CVE exists in the provided intelligence, so it should not be relied upon for detection on its own.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84395 Possible Adobe Premiere Pro SSRF Outbound Request"; flow:established,to_server; http.method; content:"GET"; http.header; content:"User-Agent"; content:"Premiere"; nocase; threshold:type both, track by_src, count 10, seconds 60; classtype:attempted-recon; sid:202684395; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=60s
  [process where process.name : "Adobe Premiere Pro*.exe"]
  [network where process.name : "Adobe Premiere Pro*.exe" and
     destination.ip != null and
     not cidr_match(destination.ip,
        "10.0.0.0/8","192.168.0.0/16","172.16.0.0/12") and
     network.direction == "egress"]

Splunk SPL Query

index=endpoint (Image="*Adobe Premiere Pro.exe" OR Image="*Adobe Premiere Pro 202*.exe")
  (EventCode=3 OR EventCode=22)
| where NOT cidr(DestinationIp,"10.0.0.0/8","192.168.0.0/16","172.16.0.0/12")
| stats count values(DestinationIp) as dests values(DestinationPort) as ports by Computer, Image
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="adobe,premiere,ssrf,">
  <rule id="100395" level="10">
    <if_sid>60106</if_sid>
    <field name="win.eventdata.image">Adobe Premiere Pro.*\.exe</field>
    <field name="win.eventdata.destinationIp">!10\.0\.0\.0/8|!192\.168\.0\.0/16|!172\.16\.0\.0/12</field>
    <description>CVE-2026-84395: Adobe Premiere Pro made an outbound connection to an external address - possible SSRF.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_84395,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, affected-version list, or patch reference was supplied by any tracked source.

1. Immediate mitigations (compensating controls).

   • Apply network egress filtering on hosts running Adobe Premiere Pro, restricting outbound traffic to known-good Adobe and organizational destinations. This directly constrains the reachable resource set for any SSRF.
   • Restrict the local attack surface: limit which accounts and processes can run or interact with Premiere Pro, given the AV:L vector. Enforce least privilege on editing workstations.
   • Monitor for and alert on unexpected outbound requests originating from the Premiere Pro process, using the detection content above as a starting point.
   • Where feasible, isolate editing workstations from sensitive internal services (shared storage, management interfaces, internal web services) that an outbound request from the application could reach.
   • Because writes are the impacted asset (I:H), enforce integrity controls — backups, versioning, and write-protected shares — for resources reachable by editing hosts.

2. Patch / upgrade steps.

   • No patch is currently available per tracked sources. Monitor Adobe's security bulletin channel (Adobe Security Bulletins) and the Adobe Product Security Incident Response Team (PSIRT) advisories for a fix, and the NVD entry for CVE-2026-84395 for update references. Apply updates immediately once released. Until then, treat the product as unpatched.

3. Long-term hardening.

   • Adopt an SBOM/asset inventory practice so all Premiere Pro installs can be located and updated rapidly when a fix ships.
   • Establish and enforce an allowlist-based egress policy for creative-application workstations.
   • Segment editing networks from high-value internal services to limit the reach of changed-scope (S:C) impacts.
   • Track EPSS and CISA KEV for this CVE; if it is added to KEV or receives a high EPSS score, elevate response priority accordingly.

References

• NVD — CVE-2026-84395: https://nvd.nist.gov/vuln/detail/CVE-2026-84395
• CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• FIRST.org EPSS — not yet scored for this CVE (no published value as of this report): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-84395 is not listed as of this report: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Adobe Security Bulletins and Advisories (vendor channel to monitor for the eventual fix): https://helpx.adobe.com/security.html

No public proof-of-concept, exploit code, Nuclei template, or evidence of in-the-wild exploitation or threat-actor campaigns was identified in the intelligence available for this CVE.