What is the CVSS score of CVE-2025-46840?

CVE-2025-46840 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Experience Manager are affected by CVE-2025-46840?

Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a privilege escalation vulnerability that could allow attackers to hijack user sessions and access sensitive content without proper…

How to fix or mitigate CVE-2025-46840?

Within 24 hours: Inventory all Adobe Experience Manager deployments and identify systems running version 6.5.22 or earlier; assess user exposure by reviewing AEM access logs for suspicious authentication patterns. Within 7 days: Implement network segmentation to restrict AEM administrative access, enforce multi-factor authentication for all AEM accounts, and disable unnecessary user-facing features if possible. Within 30 days: Monitor Adobe's security bulletins for patch availability; prepare change management procedures for urgent deployment upon patch release; consider upgrading to newer AEM versions if patching timelines are uncertain.

Experience Manager CVE-2025-46840

EUVD-2025-17983 HIGH

Improper Authorization (CWE-285)

2025-06-10 psirt@adobe.com

Adobe Privilege Escalation Authentication Bypass Experience Manager

8.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17983

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 23:15 nvd

HIGH 8.7

DescriptionCVE.org

Adobe Experience Manager versions 6.5.22 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.

AnalysisAI

CVE-2025-46840 is an Improper Authorization vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier that allows low-privileged attackers to escalate privileges and bypass security controls, potentially achieving session takeover. The vulnerability requires user interaction and has a CVSS score of 8.7 with high confidentiality and integrity impact. While no active exploitation in the wild (KEV status) or public proof-of-concept is currently documented, the network-accessible attack vector and low attack complexity combined with privilege escalation capabilities make this a high-priority patch candidate for organizations running affected AEM instances.

Technical ContextAI

This vulnerability stems from CWE-285 (Improper Authorization), a class of flaws where access control mechanisms fail to properly validate user permissions before granting access to protected resources or operations. In the context of Adobe Experience Manager—an enterprise content management and digital experience platform—the authorization bypass likely affects access control lists (ACLs), role-based access control (RBAC), or permission inheritance mechanisms used to protect administrative functions, content repositories, or user management features. The vulnerability manifests through improper validation of user privileges when handling requests that require elevated permissions, allowing authenticated users with basic privileges to perform actions normally restricted to administrators or higher-privileged roles. This is particularly critical in AEM as it manages sensitive content, user data, and system configurations across enterprise environments.

RemediationAI

Immediate actions: (1) Identify and catalog all AEM 6.5.22 and earlier instances in your environment using vulnerability scanning tools or manual version checks via AEM admin console; (2) Apply the latest security patch immediately—Adobe typically releases patches as 6.5.23 or equivalent; check Adobe's official security advisories and PSIRT updates for exact patch versions; (3) Prioritize patching of internet-facing AEM instances and those handling sensitive content; (4) As interim mitigation pending patch deployment: (a) restrict network access to AEM instances via WAF, firewall rules, or IP whitelisting, limiting exposure to low-privilege authenticated users; (b) enforce multi-factor authentication (MFA) for AEM user accounts to reduce session takeover risk; (c) monitor access logs and session activity for anomalous privilege escalation attempts or unauthorized administrative actions; (d) review and audit current user role assignments and remove unnecessary elevated privileges; (5) After patching, validate remediation by re-scanning with security tools and reviewing authorization controls in test environments before production deployment. References: Monitor Adobe Security Bulletins (https://helpx.adobe.com/security.html) and Adobe PSIRT communications for official patch links and detailed remediation guidance.