Adobe Experience Manager EUVD-2026-100557

Exploitation requires the attacker to hold a low-privileged authenticated account on the Adobe Experience Manager instance (CVSS PR:L), after which the Incorrect Authorization flaw allows actions beyond the granted permission level with no user interaction (UI:N). The condition is simply having any valid low-level credential on a network-reachable AEM 6.5 (≤6.5.25) or AEM 6.5 LTS (≤SP3) deployment; no special product feature toggle is named in the advisory. Limiting factors: the requirement for a valid authenticated session means fully anonymous exploitation is not indicated, and only unpatched 6.5/6.5 LTS versions within the stated ranges are affected - externally exposed author/publish instances that permit low-privilege account registration or have broad internal user bases face the highest realistic risk.

This is a genuine high-priority issue, not a CVSS-inflated one. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) describes network-reachable exploitation with low attack complexity, no user interaction, a changed scope, and total confidentiality/integrity/availability impact, requiring only low-level privileges (PR:L) rather than none. For an Incorrect Authorization flaw (CWE-863) yielding arbitrary code execution, PR:L is consistent and credible - an attacker needs some authenticated foothold (e.g., a basic author/user account) but then crosses an authorization boundary into code execution with scope change. No EPSS score, no CISA KEV listing, and no POC indicator are present in the provided data, so there is no evidence of active or automated exploitation yet; exploitation status is best characterized as no public exploit identified at time of analysis. The signals are internally consistent (vendor-reported by Adobe PSIRT, critical severity, scope change aligns with privilege elevation described in the text), with the main caveat that exploitation-probability signals (EPSS) and real-world-exploitation signals (KEV/POC) are simply absent rather than contradictory - their absence should not be read as low risk for an internet-facing enterprise CMS. Prioritize patching given the AV:N/low-complexity profile and critical impact, especially on externally exposed AEM author/publish instances.

An attacker who holds a low-privileged authenticated account on an internet-reachable Adobe Experience Manager instance sends crafted requests that abuse an authorization check failure to perform actions beyond their permission level, achieving arbitrary code execution in the context of the current user without any user interaction. Because scope is changed, the attacker can leverage this to gain elevated access or control over other accounts, sessions, or resources beyond the initially vulnerable component. No public proof-of-concept is identified in the available data, but the low attack complexity makes reliable exploitation plausible once details are known.