CVE•Published 2026-03-10•Modified 2026-08-28•1 article on news•4 live references•NVD data
CVE-2026-21333Adobe · Illustrator
Vulnerability data via NVD (ingested)
CVSS v3.1
8.6
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS percentile
6
Exploit Prediction Scoring System · top 94% of all CVEs
Weaknesses (CWE)
Description
Illustrator versions 29.8.4, 30.1 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Timeline
Published 2026-03-10
Modified 2026-08-28
External references
Search for exposed instances
Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).
Shodan · vuln tag0 hosts
vuln:CVE-2026-21333Hosts Shodan has explicitly fingerprinted as vulnerable.
Shodan · product
product:"Adobe Illustrator"All exposed Adobe Illustrator instances — cross-reference with the CVE's affected-version range.
Shodan · banner/body mention
http.html:"Illustrator"HTTP body or banner mentions "Illustrator" — catches deploys Shodan didn't identify as a product.
More intel sources (5)
Shodan report
vuln:CVE-2026-21333Country / ASN / product breakdown for the vuln query.
Censys
vulnerabilities.cve_id: CVE-2026-21333Censys host search filtered to this CVE id.
grep.app
CVE-2026-21333Public source-code mentions — fast PoC discovery.
GitHub code
CVE-2026-21333GitHub code search for direct mentions.
Google dork
"CVE-2026-21333" exploit -site:nvd.nist.govWrite-ups and news, NVD excluded.
Known PoCs on GitHub (8)
CVE-2026-213338 repos
gmh5225/awesome-game-securityPython
awesome game security [Welcome to PR]
GhostTroops/TOPShell
TOP All bugbounty pentesting CVE-2023- POC Exp RCE example payload Things
Ostorlab/KEVunknown
Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsunami, Ostorlab's Asteroid and Bug Bounty programs.
Karmanya03/OverthroneRust
**(WIP)** Overthrone - The First All-Rust Active Directory exploitation framework. A single static binary that takes you from network access to Domain Admin to finished report - ze…
AndrewAltimit/exploitsPython
Security research and exploit development: vulnerability analysis, exploit chain implementation, post-exploitation tradecraft, and defensive assessment tooling. Covers browser engi…
liamromanis101/K8s-container_escape_auditShell
Look for possible escape vectors from a container
Executioner1939/awesome-engineering-researchPython
Interesting Books, Articles and Videos
rxerium/CISA-KEVPython
An automated repo to track Nuclei template scanning capabilities against the CISA KEV.