EUVD-2026-100554
GHSA-h975-wwvw-q4xg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach internet-facing AEM instance
-
DeliverySend crafted unauthenticated request
-
ExploitBypass incorrect authorization check
-
ExecutionTrigger arbitrary code execution
-
PersistElevate access / hijack session
-
ImpactCompromise adjacent systems (scope change)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires only network access to the Adobe Experience Manager instance with no authentication and no user interaction, making internet-exposed AEM Cloud Service, 6.5 LTS (≤SP3), and 6.5 (≤6.5.25) deployments directly reachable by remote unauthenticated attackers. The incorrect authorization flaw (CWE-863) means the defective access-control check itself is the entry point rather than a non-default feature toggle; the description cites no special configuration prerequisite. The primary limiting factor is network reachability - instances isolated behind VPNs, WAFs, or not exposed to untrusted networks substantially reduce exposure - and affected-version boundaries: builds at or above the fixed releases (AEM as a Cloud Service >2026.9.28187, 6.5 LTS >SP3, 6.5 >6.5.25) are not vulnerable. |
| Impact | This is a genuine top-priority vulnerability, not a high-CVSS-but-low-risk inflation case. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes the worst realistic profile: network-reachable, low attack complexity, no privileges, no user interaction, with a scope change amplifying impact beyond the vulnerable component to full confidentiality, integrity, and availability compromise. CWE-863 (Incorrect Authorization) combined with the 'Authentication Bypass' and 'RCE' tags is internally consistent - a broken authorization check is leveraged to reach code execution. Signals that would normally refine urgency are MISSING: no EPSS exploitation-probability score was supplied, there is no CISA KEV listing in the input, and no proof-of-concept is referenced, so this is 'no public exploit identified at time of analysis.' The absence of EPSS/KEV/POC does not lower the inherent risk - it only means exploitation-in-the-wild cannot be confirmed from this data. Given that the flaw is attributed by Adobe's own PSIRT (psirt@adobe.com) and carries a maximal score against a widely deployed enterprise CMS, defenders should treat it as emergency-patch-worthy regardless of the currently unknown exploitation telemetry. |
| Exploit ScenarioDerived | A remote unauthenticated attacker sends crafted requests to an internet-facing Adobe Experience Manager instance, abusing the incorrect authorization check to bypass access controls and execute arbitrary code in the context of the current user. Because scope is changed, the attacker can pivot to gain elevated access or hijack the victim's account/session beyond the initially vulnerable component. No proof-of-concept is referenced in the available data, so exploitation is currently theoretical based on the vendor advisory rather than observed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unauthenticated remote code execution affects Adobe Experience Manager, specifically AEM as a Cloud Service builds up to and including 2026.9.28187, AEM 6.5 LTS up to and including SP3, and AEM 6.5 up to and including 6.5.25, and is rooted in an incorrect authorization check (CWE-863) that carries a maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Because the defective access-control decision itself is the entry point, a remote attacker needs only network reachability, no credentials, and no user interaction, and the changed scope (S:C) means the resulting arbitrary code execution in the current user's context can be leveraged to gain elevated access or control over a victim's account or session beyond the vulnerable component. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the unauthenticated, no-interaction exploitation profile places internet-exposed AEM instances at top-priority risk, with network isolation (VPN, WAF, non-exposed tiers) and the affected-version boundaries as the main mitigating factors.
RemediationAI
No vendor-released patch version was identified in the supplied intelligence for this CVE; Adobe Security Bulletin APSB26-152 (https://helpx.adobe.com/security/products/experience-manager/apsb26-152.html) is the authoritative source and must be checked for the current fixed build for each branch, since builds above the enumerated affected ranges (Cloud Service newer than 2026.9.28187, 6.5 LTS above SP3, 6.5 above 6.5.25) fall outside the vulnerable set and updating to the newest available service pack or Cloud Service build is the primary action. Until a fixed build is applied, the decisive compensating control is reducing network reachability, because the only practical exploitation prerequisite is access to the AEM HTTP surface: place author and publish instances behind a VPN or zero-trust proxy and restrict inbound access to trusted administrative networks, accepting the trade-off that this breaks access for remote or public users, or front the instances with Adobe Dispatcher and a WAF using strict allow-list filter rules for known application paths, accepting that overly broad blocking of query-builder, /bin, or legacy servlet endpoints can break legitimate integrations and should be validated in staging. Additional measures include disabling or restricting anonymous access permissions in AEM's user/group configuration and removing unused default servlets (recognizing this may break public publish sites that legitimately serve anonymous traffic), blocking external reachability of administrative consoles such as /crx and /system/console at the network layer, and enabling verbose audit logging on authorization decisions to detect probing of the affected endpoints. These measures are mitigations only; they do not correct the underlying incorrect authorization check and should be retired once a patched build is deployed. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV), so patching urgency is driven by the unauthenticated, no-interaction attack profile rather than observed in-the-wild activity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe Experience Manager is an enterprise Java content-management platform built on Apache Sling, Jackrabbit Oak, and an OSGi container, exposing HTTP endpoints through AEM servlets across separate author, publish, and Dispatcher tiers. The root cause class here is CWE-863 (Incorrect Authorization): the product does perform an authorization check on the affected functionality, but that check is implemented incorrectly or is applied to the wrong security context, so an actor that should be denied is granted the component's privileges. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms the flaw is reachable over the network with low attack complexity, no prior authentication, and no victim interaction, meaning the misconfigured or missing permission validation is on an anonymously reachable surface rather than behind a non-default feature toggle. The S:C (scope changed) metric indicates the authorization bypass lets the attacker affect resources under a different security authority than the vulnerable component, consistent with the advisory language of arbitrary code execution in the context of the current user and escalation to a victim's account or session; the accompanying tags (Authentication Bypass, RCE) align with an authorization-boundary defect that escalates into code execution. No CPE strings were supplied in the source data; affected builds are enumerated by the ENISA EUVD entry EUVD-2026-100554.
Know when Adobe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Incorrect-authorization bypass is remotely reachable with no auth or interaction (AV:N/AC:L/PR:N/UI:N); resulting code execution crosses a security boundary (S:C) yielding full C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
Executive ViewAI
Adobe Experience Manager, across AEM as a Cloud Service builds up to and including 2026.9.28187, AEM 6.5 LTS up to and including SP3, and AEM 6.5 up to and including 6.5.25, contains a maximum-severity authorization defect that allows an unauthenticated attacker with only network reachability to execute arbitrary code and potentially seize control of user accounts or sessions. Any internet-exposed AEM instance - typically customer-facing websites, portals, and digital asset repositories - is therefore a high-value target, and the flaw's scope-changing behavior means compromise can extend beyond the vulnerable component into adjacent systems and identity contexts. Leadership should treat this as a top-priority exposure because no vendor patch is currently available, so protection depends entirely on reducing reachability and strengthening detection until a fix ships.
No vendor-released patch identified at time of analysis. Until Adobe publishes a fix, enforce network-level controls: remove affected AEM instances from direct internet exposure and place them behind VPN, zero-trust access, or IP allowlists; apply WAF and load-balancer or dispatcher rules to reject unauthenticated requests to administrative, access-control, and code-execution-adjacent endpoints in the Author and Publish tiers; segment AEM hosts from internal management networks and restrict outbound egress; apply least privilege to AEM service accounts and rotate privileged credentials and session tokens; enable detailed logging with alerting for anomalous sessions, unexpected process spawns, and unusual egress; and maintain immutable, tested backups to support recovery. Continue monitoring Adobe's advisory for an updated release and patch immediately when one becomes available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Exploit-DB