Adobe has released security updates for Premiere Pro on Windows and macOS after identifying a critical vulnerability that could allow a security feature to be bypassed.
The September 22 bulletin says Adobe is not aware of the vulnerability being exploited in the wild. The company nevertheless recommends moving to the newest available version through the Creative Cloud desktop app.
Featured photo: Joe Mabel, via Wikimedia Commons, licensed under CC BY-SA 4.0. The image is illustrative; the depicted facility is not connected to Adobe's advisory.
Why it matters
Editors often keep production systems on a stable software build until a project is delivered. That caution is understandable, but a security update changes the tradeoff: teams need to weigh project compatibility against leaving a known critical issue unpatched. The safest production workflow is to back up projects, confirm plug-in compatibility, test the update on a non-critical machine or duplicate environment, and then schedule the rollout.
Versions named in the bulletin
Adobe lists Premiere version 26.3.2 and earlier, plus Premiere Pro version 25.6.5 and earlier, as affected on both Windows and macOS. The fixed releases are version 26.5 and version 25.6.6, respectively.
The issue is tracked as CVE-2026-84395. Adobe describes it as a server-side request-forgery vulnerability with a CVSS base score of 7.1 and a potential security-feature-bypass impact. The bulletin assigns the update a priority rating of 3.
A practical update checklist
- Confirm which Premiere build is installed on every editing workstation.
- Back up project files, shared productions, presets, and custom workspaces.
- Check that required plug-ins, panels, codecs, and hardware drivers support the target release.
- Test an active project and its export path before updating every machine.
- Use the Creative Cloud desktop app, or the Admin Console in a managed environment, to deploy the fixed release.
An update should not become a mid-delivery surprise. Facilities and independent editors can reduce risk by documenting their current build, testing first, and ensuring collaborators do not accidentally split a shared project across incompatible versions.
Update note
Published September 24, 2026, from Adobe's September 22 security bulletin. Spotlight News will update this report if Adobe changes the affected-version list or reports active exploitation.