Adobe Experience Manager EUVD-2026-100552

Exploitation requires an existing low-privileged authenticated account on the Adobe Experience Manager instance (PR:L) - it is NOT remote-unauthenticated. The attacker sends a crafted request to a feature backed by a vulnerable SQL query path lacking proper input neutralization (CWE-89); no user interaction is needed (UI:N). Limiting factors: the requirement for valid low-privilege credentials narrows the attacker pool, and only AEM 6.5 builds up to and including 6.5.25 are affected, so patched instances (post-6.5.25 / APSB26-152 fix) and instances without attacker-obtainable accounts are not exposed. Network reachability to the AEM author/publish endpoint is also required.

This is a moderate-priority vulnerability rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, base 7.1) indicates network-reachable, low-complexity exploitation requiring low privileges and no user interaction, with high confidentiality impact but only limited integrity impact and no availability impact - consistent with a SQL injection enabling broad read access and constrained write access. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public POC is referenced, so there is no public exploit identified at time of analysis. The key tension is that PR:L means an attacker must already hold at least a low-privileged authenticated account on the AEM instance, which materially raises the bar versus a fully unauthenticated flaw; for internet-exposed AEM author/publish instances with self-registration or weak account provisioning this is easier, while hardened deployments limit the attacker pool. Net: a genuine vulnerability warranting prompt patching on exposed AEM systems, but not a drop-everything emergency absent evidence of active exploitation. Missing data to note: no EPSS, no KEV, no POC confirmation, and no independent confirmation of exploit maturity.

A low-privileged authenticated user of an Adobe Experience Manager 6.5 instance submits a crafted request containing malicious SQL fragments to a vulnerable, improperly-sanitized query path. This bypasses intended security controls, letting the attacker read sensitive data they should not access and perform limited unauthorized writes. No public exploit code is currently identified, and no user interaction is required.