EUVD-2026-44386
GHSA-5p7j-5g9r-9wjx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Network XXE needing a low-privilege account (PR:L) and no interaction; primary impact is sensitive file read (C:H) with scope change to internal systems (S:C) and only limited integrity effect.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to read sensitive files, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
Articles & Coverage 1
AnalysisAI
Sensitive file disclosure and potential account takeover in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6.5 LTS) arises from unsafe XML External Entity (XXE) processing that Adobe classifies as leading to arbitrary code execution in the current user's context. A low-privileged, authenticated attacker (PR:L) can trigger the flaw remotely over the network with no user interaction, reading protected files and pivoting to elevated access or session control. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.6 CVSS score and scope-change make it a high-priority patch.
Technical ContextAI
The root cause is CWE-611 (Improper Restriction of XML External Entity Reference). AEM is a Java-based enterprise content management and digital experience platform that heavily parses XML for content packages, configuration, workflows, and web service payloads. When an underlying XML parser is left with external entity resolution enabled and processes attacker-controlled XML, an attacker can define external entities that reference local filesystem paths or internal URLs. This lets the parser be coerced into reading files it should not (e.g., credentials, configuration, keystores) and, per Adobe, escalating to code execution in the current user's context. The affected CPEs are cpe:2.3:a:adobe:adobe_experience_manager_as_a_cloud_service, cpe:2.3:a:adobe:adobe_experience_manager_6.5_lts, and cpe:2.3:a:adobe:adobe_experience_manager_6.5, indicating both the managed cloud service and on-premise/AMS 6.5 code lines share the vulnerable parsing path.
RemediationAI
Apply the fixes described in Adobe Security Bulletin APSB26-74 (https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html) - Patch available per vendor advisory; the exact fixed build for AEM 6.5 / 6.5 LTS should be pulled from that bulletin as the input did not include a specific version string, and AEM as a Cloud Service updates are delivered by Adobe on the managed release train, so ensure your cloud environment is on the current release. Until patched, reduce exposure by restricting network access to AEM author and admin interfaces (which is where XML-consuming endpoints typically live) to trusted VPN/IP ranges rather than the open internet, and tighten account provisioning so low-privilege accounts that could reach XML-processing endpoints are minimized - trade-off is potential disruption to legitimate remote authors. Where a WAF fronts AEM, add rules to block XML payloads containing DOCTYPE/ENTITY declarations and SYSTEM/PUBLIC external references, accepting that aggressive XML filtering can break legitimate content-package or web-service traffic and should be tested first.
Server-Side Request Forgery in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets a low-privileged
Arbitrary file system read in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets remote unauthenti
Missing authentication in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6.5 LTS) lets a remote unauthentica
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persist
Stored Cross-Site Scripting in Adobe Experience Manager enables a low-privileged authenticated attacker to inject persis
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to inject and execute
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to manipulate client-side DO
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated network-accessible attackers to inject a
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malici
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute malicious
Share
External POC / Exploit Code
Leaving vuln.today