EUVD-2026-44379
GHSA-jjf4-ppfx-v66m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Missing authentication makes it network-reachable and unauthenticated (AV:N/PR:N/AC:L/UI:N); impact is unauthorized write (I:H) with no confidentiality or availability loss, and the cross-boundary function yields S:C.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Experience Manager is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
Missing authentication in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6.5 LTS) lets a remote unauthenticated attacker reach a critical function directly, bypassing a security control to gain unauthorized write access. The CVSS 8.6 rating and scope-change flag indicate impact can extend beyond the initially vulnerable component, though only integrity is affected (no confidentiality or availability loss). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
Adobe Experience Manager is Adobe's enterprise content management and digital experience platform, delivered both as a managed cloud service (AEM as a Cloud Service) and as on-premise/AMS deployments (AEM 6.5 and the 6.5 LTS long-term-support line). The root cause is CWE-306 (Missing Authentication for Critical Function): a sensitive operation that should be gated behind an authentication check is instead reachable without valid credentials. Because AEM exposes numerous OSGi-backed servlets and administrative/authoring endpoints over HTTP, an endpoint that performs a state-changing 'critical function' without verifying identity allows callers to invoke it directly. The CVSS scope change (S:C) implies the abused function acts across a trust/authorization boundary, so the effect lands on resources managed by a component other than the vulnerable one.
RemediationAI
Apply the fix per Adobe advisory APSB26-74 (https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html); the provided data does not contain an exact patched build number, so treat this as 'Patch available per vendor advisory' and pull the precise version and service-pack/hotfix identifiers from that advisory for AEM 6.5 and 6.5 LTS. AEM as a Cloud Service is updated by Adobe on the managed release channel, so ensure your environment is on the current release. Until patched, reduce exposure by restricting network access to authoring and administrative endpoints - front AEM with a dispatcher/reverse proxy that denies direct external access to the vulnerable function and to /system, /crx, and admin servlets, and enforce an allowlist so only trusted networks reach the instance; note the trade-off that overly broad dispatcher filter rules can break legitimate author/publish workflows, so validate filter changes in staging first.
Sensitive file disclosure and potential account takeover in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6
Server-Side Request Forgery in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets a low-privileged
Arbitrary file system read in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets remote unauthenti
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persist
Stored Cross-Site Scripting in Adobe Experience Manager enables a low-privileged authenticated attacker to inject persis
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to inject and execute
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to manipulate client-side DO
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated network-accessible attackers to inject a
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malici
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute malicious
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today