EUVD-2026-44387
GHSA-mqxm-pgxg-3pr2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Network-reachable SSRF needing a low-privileged authenticated foothold (PR:L), no user interaction, scope changed to internal targets with high confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Experience Manager is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could leverage this vulnerability to issue unauthorized server-side requests, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
Articles & Coverage 1
AnalysisAI
Server-Side Request Forgery in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets a low-privileged, authenticated attacker coerce the server into issuing crafted requests that can escalate to arbitrary code execution in the current user's context and hijack the victim's account or session. The scope-changed CVSS 9.6 rating reflects that the SSRF pivots beyond the vulnerable component itself. No public exploit identified at time of analysis, and no CISA KEV listing; risk is driven by CVSS severity and Adobe's confirmation via advisory APSB26-74 rather than observed exploitation.
Technical ContextAI
The root cause is CWE-918 (Server-Side Request Forgery): AEM accepts attacker-influenced input used to build an outbound request without adequately validating the destination, allowing the server to be steered toward attacker-chosen internal or external targets. AEM is a Java/OSGi (Apache Sling / Felix) enterprise content management platform, so an SSRF primitive is especially dangerous because it can reach internal management endpoints, cloud metadata services, or internal HTTP-invokable components - which per Adobe's description can escalate into code execution in the current user's context. The affected CPEs are cpe:2.3:a:adobe:adobe_experience_manager_as_a_cloud_service, cpe:2.3:a:adobe:adobe_experience_manager_6.5_lts, and cpe:2.3:a:adobe:adobe_experience_manager_6.5, spanning both the cloud service and the on-premises/AMS 6.5 lineage.
RemediationAI
Patch available per vendor advisory: apply the fixes described in Adobe Security Bulletin APSB26-74 (https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html); the exact fixed build/service-pack number was not in the provided data, so confirm the target version directly from that bulletin - AEM as a Cloud Service customers should ensure they are on the current release, and 6.5 / 6.5 LTS operators should apply the corresponding service pack or cumulative fix pack. Because exploitation requires a low-privileged authenticated foothold, compensating controls until patching include tightening AEM author/publish access so only trusted, provisioned users hold accounts, and restricting network egress from AEM instances (deny outbound access to internal management ranges and cloud metadata endpoints such as 169.254.169.254) to blunt the SSRF pivot - with the trade-off that egress filtering can break legitimate integrations (external DAM, replication, third-party services) and must be allow-listed carefully. Front AEM with a WAF/dispatcher rule set that constrains request parameters carrying URLs, noting this is defense-in-depth and not a substitute for the vendor fix.
Sensitive file disclosure and potential account takeover in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6
Arbitrary file system read in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets remote unauthenti
Missing authentication in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6.5 LTS) lets a remote unauthentica
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persist
Stored Cross-Site Scripting in Adobe Experience Manager enables a low-privileged authenticated attacker to inject persis
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to inject and execute
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to manipulate client-side DO
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated network-accessible attackers to inject a
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malici
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute malicious
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today