EUVD-2026-35624
GHSA-j3rf-4hx8-vj3q
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Redirect (Open Redirect) vulnerability that could lead to account takeover. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site. Exploitation of this issue requires user interaction in that a victim must click on a malicious link.
AnalysisAI
Open redirect in Adobe Experience Manager (versions 6.5.24, LTS SP1, 2026.04 and earlier) enables network-based attackers to craft malicious URLs that silently redirect victims to attacker-controlled sites, with Adobe's own advisory citing account takeover as the potential outcome. The attack requires no privileges or authentication on the attacker's side (PR:N per CVSS) but depends entirely on a victim clicking a crafted link (UI:R). No public exploit has been identified and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis, though the account takeover potential meaningfully exceeds what the moderate CVSS 4.3 score alone conveys.
Technical ContextAI
CWE-601 (URL Redirection to Untrusted Site) arises when a web application accepts user-supplied redirect destination parameters without validating that the target domain is trusted. Adobe Experience Manager is a widely deployed enterprise content management and digital asset management platform used heavily in corporate and government environments. Open redirect flaws in CMS platforms are especially high-value targets for phishing because the originating domain is legitimate and trusted by email security gateways and end users alike. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N confirms network delivery, low attack complexity, no required privileges, unchanged scope (no server-side pivot), and a confidentiality-only impact reflecting credential harvesting rather than direct server data exposure. Per ENISA EUVD-2026-35624, the affected range spans Adobe Experience Manager versions 0 through 2026.04, covering both the 6.5.x on-premise and managed-services LTS branch and the AEM as a Cloud Service release line.
RemediationAI
Apply the vendor-released patch per Adobe Security Bulletin APSB26-56 (https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html); the bulletin specifies the exact fixed versions for both the 6.5.x LTS and AEM Cloud Service tracks - consult it directly as specific fix version numbers were not present in the available intelligence and cannot be independently confirmed here. As a compensating control prior to patching, implement a redirect destination allowlist at the reverse proxy or WAF layer to permit only known corporate domains, blocking requests where the redirect parameter resolves to an external host; note this may break legitimate third-party integrations and requires careful allowlist scoping. Additionally, configure web application firewall rules to alert on AEM URLs containing redirect parameters pointing to external domains. Detection-oriented defenders should monitor AEM access logs for redirect parameter values containing external domains, which can identify active abuse attempts even before patching is complete.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today