EUVD-2026-100555
GHSA-hh6w-v424-vc4w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach internet-facing AEM instance
-
DeliverySend crafted unauthenticated request
-
ExploitBypass incorrect authorization check
-
ExecutionInvoke privileged code-execution path
-
PersistExecute arbitrary code (scope changed)
-
ImpactGain elevated account/session control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions confirmed - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote unauthenticated exploitation with no user interaction against reachable Adobe Experience Manager instances. The primary limiting factor is network exposure: the AEM author/publish instance (or its relevant endpoint) must be reachable by the attacker, so instances behind proper network segmentation, WAF/dispatcher filtering, or not exposed to untrusted networks have a reduced attack surface. The description does not specify a non-default feature or configuration prerequisite, so default-configured, internet-facing deployments on unpatched versions (6.5 ≤6.5.25, AEM as a Cloud Service ≤2026.9.28187, 6.5 LTS ≤SP3) should be treated as exploitable. |
| Impact | This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes the worst realistic profile: network-reachable, low complexity, no privileges, no user interaction, with a scope change and total confidentiality/integrity/availability impact. The CWE-863 (Incorrect Authorization) root cause combined with the 'Authentication Bypass' and 'RCE' tags is consistent - an authorization flaw that lets an unauthenticated remote attacker reach code-execution functionality. The source is authoritative (Adobe PSIRT, psirt@adobe.com) and a fix advisory exists (APSB26-152), which raises confidence in the technical claims. The signals are therefore internally consistent with no contradictions. The key caveats are about EXPLOITATION signals rather than severity: there is no EPSS score, no CISA KEV listing, and no POC provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The low-complexity, unauthenticated, max-impact profile of an internet-facing enterprise CMS makes this the kind of flaw that attracts rapid exploit development, so it should be patched immediately despite the current absence of exploitation telemetry. |
| Exploit ScenarioDerived | An unauthenticated attacker sends crafted requests to an internet-exposed Adobe Experience Manager instance, abusing an incorrect-authorization check to invoke functionality they should not be permitted to reach. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with a changed scope, this requires no credentials and no victim interaction, yielding arbitrary code execution and potential takeover of the account, session, or broader system. No public exploit is identified at time of analysis, but the low-complexity, unauthenticated profile makes reliable exploitation plausible once details are reverse-engineered from the patch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unauthenticated remote code execution in Adobe Experience Manager stems from an incorrect authorization check that lets a remote attacker bypass access controls and execute arbitrary code in the context of the current user, with the changed-scope rating indicating impact can extend beyond the vulnerable component (CVSS 3.1 base 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Every unpatched deployment is in scope: AEM 6.5 up to and including 6.5.25, AEM 6.5 LTS up to and including 6.5 LTS SP3, and AEM as a Cloud Service up to and including 2026.9.28187; no credentials or user interaction are required, and the only practical precondition is that the affected author, publish, or endpoint is reachable from the attacker's network. No public exploit code exists and no confirmed active exploitation (CISA KEV) has been recorded at time of analysis, but the authentication-bypass-to-RCE chain plus the maximum severity score make internet-facing, unpatched instances a top remediation priority rather than a high-score/low-real-risk case.
RemediationAI
Apply the fixes published in Adobe security bulletin APSB26-152 (https://helpx.adobe.com/security/products/experience-manager/apsb26-152.html); the provided data does not enumerate exact fixed build numbers, so confirm the target release against that advisory before upgrading. On-premise operators must move Adobe Experience Manager 6.5 past 6.5.25 and AEM 6.5 LTS past 6.5 LTS SP3, and AEM as a Cloud Service customers should verify their instance is on a build later than 2026.9.28187 - Cloud Service patching is performed by Adobe on its update cadence, so the practical action there is to confirm the instance has received the current update. Until an upgrade lands, reduce exposure with layered, concrete controls whose trade-offs should be understood: place the publish tier strictly behind the dispatcher and deny all non-dispatcher traffic to AEM ports (breaks direct integrations and some headless/API clients that bypass the dispatcher); restrict the author tier and any /crx, /system/console, /bin, and OSGi console paths to trusted management networks or VPN only (inconveniences remote content authors but removes the most likely RCE and bypass endpoints); and deploy WAF/dispatcher rules that reject anomalous or unauthenticated access to servlet and scripting paths (risk of false positives against legitimate custom servlets, so stage in monitor mode first). None of these compensate fully for the missing authorization check, so treat patching as the only definitive fix and prioritize internet-facing instances given the unauthenticated, no-interaction exploitation path and the maximum severity rating.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-863, Incorrect Authorization, in Adobe Experience Manager, a Java-based enterprise content and digital experience platform built on Apache Sling, the Granite/JCR repository, and OSGi bundles, typically deployed across separate author (content creation) and publish (delivery) tiers fronted by an Apache/mod_dispatcher layer. An incorrect or missing authorization check in this stack means a request that should have been rejected or restricted to a privileged principal is instead processed, which the accompanying 'Authentication Bypass' tag indicates can be used to reach functionality normally reserved for authenticated or administrative users. Because the flaw is described as leading to arbitrary code execution, the bypassed control most plausibly guards a servlet, scripting (e.g., JSP/HTL or Groovy/ECMAScript console) path, or OSGi/CRX endpoint that permits code or command execution on the JVM host. The changed-scope metric (S:C) is significant: it means the vulnerable component's failure lets the attacker affect resources in a different security scope than the component itself, consistent with an authorization bypass in the web layer yielding control over the underlying application server, adjacent services, or other tenants rather than merely the request's own data. The vector's PR:N/UI:N confirms the first-party authoritative assessment that no credentials and no victim interaction are needed, so the operative attack surface constraint is purely network reachability of the AEM instance and any unprotected endpoints.
Know when Adobe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Incorrect-authorization bypass is network-reachable with low complexity and no auth or interaction; scope changes as code runs beyond the vulnerable component, with full C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
Executive ViewAI
Adobe Experience Manager deployments on affected versions face a critical unauthenticated remote code execution risk that can give attackers full control of the content platform and potentially extend beyond it. Because no vendor-released patch is identified at time of analysis and the flaw requires no credentials or user interaction, any internet-reachable author, publish, or endpoint service-specifically AEM 6.5 through 6.5.25, AEM 6.5 LTS through SP3, and AEM as a Cloud Service through 2026.9.28187-is in scope. Leadership should treat this as a severe organizational exposure affecting website integrity, customer data, and service availability until mitigating controls are in place.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to AEM author, publish, and endpoint services via IP allowlisting, VPN, or zero-trust controls; deploy WAF rules to block authorization-bypass and RCE attempts; monitor logs for anomalous code execution; disable unnecessary endpoints; enforce least privilege; engage Adobe support for mitigation guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Exploit-DB