Adobe Experience Manager CVE-2026-48259

Exploitation requires the attacker to already possess a low-privileged authenticated session on the AEM instance (CVSS PR:L), and the attacker must be able to reach an AEM function that builds a server-side request from attacker-influenced input (the SSRF sink). No user interaction is required (UI:N) and the vector is network-reachable (AV:N) with low complexity (AC:L). Limiting factors that reduce real-world risk: the mandatory authenticated foothold means fully anonymous internet exploitation is not indicated by the vector, and the value of the SSRF depends on what internal targets are reachable from the AEM host - deployments with strict egress filtering and no sensitive internal HTTP endpoints materially constrain the escalation to code execution.

The signals point to a genuine high priority but not an emergency. CVSS 3.1 is 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N): network-reachable, low attack complexity, no user interaction, scope changed, and high confidentiality/integrity impact - the PR:L means some authenticated foothold is required, which modestly tempers the raw score. No EPSS score was provided, so real-world exploitation probability cannot be quantified from this data. There is no CISA KEV entry and no POC referenced, so this is not confirmed as actively exploited - the severity is theoretical-but-serious rather than proven in-the-wild. One tension to verify: Adobe describes the impact as 'arbitrary code execution' yet the CVSS vector sets A:N (no availability impact) and S:C with C:H/I:H, which is consistent with an SSRF-driven account/session takeover and data-plane RCE rather than a host-crashing memory-corruption RCE - treat the 'RCE' label as escalation-via-SSRF in the current user's context, not unauthenticated root.

An attacker who holds a low-privileged AEM account (or has phished/obtained such credentials) submits a crafted request whose URL parameter is controlled, causing the AEM server to make an unauthorized server-side request to an internal endpoint. By targeting internal services reachable only from the AEM host, the attacker escalates the SSRF into code execution in the current user's context and takes over the victim's account or session - no user interaction is required. No public exploit code is referenced, so this reflects the low-complexity attack path implied by the CVSS vector rather than a published PoC.