Adobe Experience Manager CVE-2026-106634

Exploitation requires an authenticated low-privileged account on the affected Adobe Experience Manager instance (CVSS PR:L) - it is NOT remote-unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once an attacker holds any valid low-privilege AEM credential and can reach the service over the network, a single crafted request manipulating a pathname can write files outside the intended directory. Affected deployments are AEM 6.5 LTS up to and including SP3 and AEM 6.5 up to and including 6.5.25. The principal limiting factors are the authentication requirement and network reachability of the AEM instance (author instances in particular should not be internet-exposed); impact is limited to file-system integrity (write), with no direct confidentiality or availability impact per the vector.

This is a moderately serious, prioritize-with-context issue rather than a drop-everything emergency. The CVSS 3.1 score of 7.7 (High) is driven by a network attack vector (AV:N), low attack complexity (AC:L), no user interaction (UI:N), and a changed scope (S:C), with integrity-only impact (I:H; C:N/A:N) reflecting arbitrary file-system write. The one meaningful brake is PR:L - the attacker must already hold a low-privilege authenticated account on the AEM instance, which rules out anonymous internet-wide exploitation and points toward insider, compromised-credential, or multi-tenant author-instance scenarios. No EPSS score, KEV listing, or public POC was provided in the intelligence, so there is currently no evidence of active exploitation or weaponization - the real-world threat is presently theoretical and gated by access. Signals are internally consistent (no CVSS-vs-description conflict), but exploitation-probability data (EPSS) is entirely absent, so likelihood cannot be quantified. Net: treat as a high-value patch target for internet-exposed or multi-user AEM author instances (where a path-traversal write can lead to code execution or config tampering) but not a confirmed in-the-wild emergency.

An attacker who has obtained a low-privileged account on an Adobe Experience Manager author or publish instance sends a crafted request that manipulates a pathname parameter to escape the intended directory and write a file to an unauthorized location. Because low attack complexity and no user interaction are required, a single authenticated request can drop or overwrite a file - for example planting a script in a web-served or configuration directory to pivot toward code execution or privilege escalation. No public exploit code was identified at time of analysis, so this reflects the mechanism implied by the CVSS vector rather than a demonstrated exploit.