Adobe Experience Manager EUVD-2026-100561

Requires an authenticated low-privileged account on an Adobe Experience Manager instance (PR:L) and access to a feature or endpoint that parses attacker-supplied XML with external entity resolution enabled - the classic XXE precondition. No user interaction is required (UI:N) and the vector is network-reachable (AV:N). Limiting factors: the attacker must first obtain valid low-tier credentials (e.g., an author/contributor role), so fully unauthenticated exploitation is not supported by the CVSS data; exposure is greatest on author instances or deployments where such accounts are broadly provisioned. Affected builds are AEM 6.5 up to 6.5.25, AEM as a Cloud Service up to 2026.9.28187, and AEM 6.5 LTS up to SP3; patched versions are not exploitable.

This is a genuinely high-priority issue, not a CVSS-inflated one. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, 9.6) describes a network-reachable XXE requiring only low privileges and no user interaction, with a changed scope - meaning the attacker pivots from the AEM component into internal resources, which is what drives the critical score. Adobe PSIRT is the reporting source and a vendor advisory (APSB26-152) exists, so the vulnerability and fix are confirmed by the vendor. However, no EPSS score, CISA KEV listing, SSVC decision data, or public POC is present in the supplied intelligence, so there is no evidence of active exploitation or published exploit code at this time - risk is driven by the intrinsic exploitability (low complexity, low-privilege prerequisite that is easily met in multi-tenant/author environments) rather than by observed in-the-wild activity. The main caveat: the vector requires PR:L (an authenticated low-privileged account), so 'unauthenticated' exploitation is NOT supported by the data; the realistic threat is a low-tier authenticated user (e.g., a content author) escalating to internal/privileged resources.

A low-privileged authenticated user (such as a content author on an AEM author instance) submits a crafted XML document to a feature that parses XML with external entity resolution enabled. The malicious external entity forces the server to fetch internal files or make requests to internal network resources, yielding elevated access to data and systems beyond the attacker's original privilege level. No user interaction is needed and attack complexity is low; no public exploit code was identified in the provided data.