What is the CVSS score of CVE-2026-19232?

CVE-2026-19232 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

How to fix or mitigate CVE-2026-19232?

Within 24 hours: Inventory all Adobe Experience Manager deployments, identifying versions, deployment type (on-premises vs. Cloud Service), and internal user access controls. Within 7 days: Apply the vendor-released patch from Adobe security advisory APSB26-98 to all affected AEM instances (6.5 through 6.5.24, Cloud Service through 2026.7.0, 6.5 LTS through SP2), prioritizing Cloud Service environments first followed by on-premises installations; consult APSB26-98 for exact patched versions applicable to each deployment type. For instances that cannot be patched immediately, implement network segmentation to restrict low-privileged user access to AEM environments. Within 30 days: Confirm patching completion across all instances, review authentication and authorization logs for anomalous low-privileged account activity dating back to 2026-07-01, and validate that no unauthorized code execution or account compromise occurred.

Adobe Experience Manager CVE-2026-19232

EUVD-2026-74243 CRITICAL

Incorrect Authorization (CWE-863)

2026-09-08 psirt@adobe.com

GHSA-5q5f-6932-j76w

Authentication Bypass RCE Adobe Experience Manager

9.9

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable, low-complexity authz flaw needing only a low-privileged account (PR:L) with no interaction; code execution plus scope change to other accounts justifies S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 08, 2026 - 21:38 vuln.today

CVE Published

Sep 08, 2026 - 20:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. A low-privileged attacker could exploit this vulnerability to gain elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

Articles & Coverage 1

News Critical Privilege Escalation RCE in Adobe Experience Manager - CVE-2026-19232 Sep 09, 2026

AnalysisAI

Privilege escalation to arbitrary code execution in Adobe Experience Manager (AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2) lets a low-privileged authenticated attacker abuse an incorrect-authorization flaw to execute code and take over a victim's account or session without any user interaction. Because the CVSS scope is changed, the impact extends beyond the vulnerable component. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires a valid low-privileged authenticated account on an affected AEM instance (CVSS PR:L) that is network-reachable (AV:N); no user interaction and no special client-side conditions are needed (UI:N, AC:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals point to a genuine high priority for internet-exposed or multi-tenant AEM authoring/publish deployments: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, C:H/I:H/A:H = 9.9) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, with a scope change that magnifies blast radius. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: apply Adobe APSB26-98 - upgrade AEM 6.5 to the fix released above 6.5.24, AEM as a Cloud Service to the release after 2026.7.0, and AEM 6.5 LTS to the service pack above SP2, per https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html. … Detailed patch versions, workarounds, and compensating controls in full report.