What is the CVSS score of CVE-2026-48288?

CVE-2026-48288 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Adobe Experience Manager CVE-2026-48288

EUVD-2026-35714 LOW

Improper Input Validation (CWE-20)

2026-06-09 psirt@adobe.com

GHSA-8m39-gx85-849m

Authentication Bypass Adobe Experience Manager

3.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

3.5 LOW

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:09 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

AnalysisAI

Security feature bypass in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, and 2026.04 and earlier allows a low-privileged authenticated attacker to gain unauthorized write access by exploiting improper input validation. Exploitation requires user interaction - a victim must be socially engineered into visiting a maliciously crafted URL or interacting with a compromised web page. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; the CVSS score of 3.5 (Low) reflects constrained impact limited to integrity only, with no confidentiality or availability exposure.

Technical ContextAI

Adobe Experience Manager is an enterprise content management and digital experience platform widely deployed for web content authoring and delivery. The vulnerability is rooted in CWE-20 (Improper Input Validation), meaning the application fails to properly sanitize or validate attacker-controlled input before it is processed by a security-relevant code path. This allows input to circumvent access controls or validation logic that would otherwise restrict write operations. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) confirms the affected component is network-accessible, requires no special configuration complexity, but does demand a low-privileged session and victim interaction. EUVD-2026-35714 corroborates the affected range as all AEM versions up to and including 2026.04. The improper validation likely resides in a content submission or URL-processing pathway where privilege enforcement can be bypassed under attacker-influenced conditions.

RemediationAI

The primary remediation is to apply the vendor-released fix documented in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The exact patched version number is not independently confirmed in the available input data - consult APSB26-56 directly to identify the specific service pack, cumulative fix pack, or cloud release that addresses CVE-2026-48288. As a compensating control while patching is in progress, administrators should review and restrict the scope of low-privileged roles with write permissions in AEM, limiting contributor or author access to only trusted internal users. Deploying a web application firewall to inspect and block anomalous input patterns targeting AEM content submission endpoints can reduce the attack surface, though this does not fully remediate the underlying validation flaw. Disabling external access to AEM authoring environments where not operationally required eliminates the network attack vector (AV:N) entirely and represents the strongest interim mitigation.