Adobe Experience Manager CVE-2026-90532

Requires a network-reachable Adobe Experience Manager instance running an affected version: AEM as a Cloud Service at or below 2026.9.28187, AEM 6.5 LTS at or below SP3, or AEM 6.5 at or below 6.5.25. Per CVSS PR:N/UI:N/AC:L, no authentication, no user interaction, and no special non-default configuration are stated as prerequisites - the incorrect authorization check (CWE-863) is the exploitable condition itself, so any exposed affected instance is at risk. The primary limiting factor is reachability: instances not exposed to the attacker's network (e.g., author instances behind internal networks or a WAF/dispatcher restricting access) materially reduce exposure, whereas internet-facing or publish-tier deployments are directly exploitable. Patching to the fixed versions referenced in APSB26-152 removes the condition.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction, with a scope change and full confidentiality/integrity/availability impact - effectively the worst-case profile. The CWE-863 (Incorrect Authorization) root cause aligns with the 'Authentication Bypass' tag, and Adobe PSIRT's own reporting (psirt@adobe.com) plus the APSB26-152 advisory lend high vendor confidence. SSVC-style reasoning: technical impact is Total and the flaw is plausibly Automatable given unauthenticated network access, which argues for an Act/urgent response. HOWEVER, key enrichment signals are MISSING from the input: there is no EPSS score, no CISA KEV listing, and no confirmed public POC provided. Per the precision rules this means exploitation status is 'no public exploit identified at time of analysis' - the maximal CVSS reflects potential severity, not observed in-the-wild activity. The 'RCE' tag indicates code execution potential consistent with the description's 'arbitrary code execution in the context of the current user,' though note the description frames impact as 'in the context of the current user' and 'control over the victim's account or session,' which is slightly narrower phrasing than full-system RCE - verify the exact execution context with Adobe. Bottom line: treat as an emergency patch due to the 10.0 vector and unauthenticated network reachability, while recognizing that real-world exploitation prevalence is currently unquantified.

A remote, unauthenticated attacker sends a crafted request to an internet-exposed Adobe Experience Manager instance, abusing the incorrect authorization check to bypass access controls and execute arbitrary code in the current user's context. Because the scope is changed, the attacker can pivot beyond the vulnerable component to gain elevated access or hijack the victim's account or session. No public exploit is identified at time of analysis, but the AC:L/PR:N/UI:N profile means a working exploit would be straightforward to operate once developed.