What is the CVSS score of EUVD-2026-35635?

EUVD-2026-35635 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Adobe Experience Manager EUVD-2026-35635

| CVE-2026-48289 LOW

Improper Input Validation (CWE-20)

2026-06-09 psirt@adobe.com

GHSA-c3rc-pj8m-f5fv

Adobe Authentication Bypass

3.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.5 LOW

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:08 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

AnalysisAI

Security feature bypass in Adobe Experience Manager (versions up to 6.5.24, LTS SP1, and 2026.04) allows a low-privileged authenticated attacker to gain unauthorized write access through improper input validation. Despite the 'Authentication Bypass' tag, the CVSS PR:L vector clarifies the attacker already holds a low-privilege account and uses this flaw to circumvent an additional security control - not to bypass authentication itself. Exploitation requires social engineering a victim to visit a maliciously crafted URL or interact with a compromised web page, and no public exploit has been identified at time of analysis.

Technical ContextAI

Adobe Experience Manager (AEM) is an enterprise-grade Java-based CMS and digital asset management platform widely deployed in large organizations for web content delivery and marketing operations. The root cause is CWE-20 (Improper Input Validation): the application fails to adequately validate or sanitize attacker-controlled input at a security decision boundary, allowing a crafted request to circumvent a write-access control. ENISA EUVD-2026-35635 corroborates the affected range as all AEM versions up to and including 2026.04. The CVSS unchanged scope (S:U) indicates the bypass is contained within the AEM application boundary and does not allow pivoting to the underlying OS or adjacent systems. No explicit CPE string was provided in the input data.

RemediationAI

Apply the vendor-released patch per Adobe Security Bulletin APSB26-56, available at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html - the exact patched version number is not independently confirmed from the provided input data, so administrators should consult the bulletin directly to identify the correct target release. As a compensating control prior to patching, restrict access to AEM authoring environments to trusted internal networks or VPN, reducing the attacker pool to those with existing network-level access. Additionally, reviewing and tightening AEM access control lists to remove unnecessary low-privilege write permissions for the affected content paths may reduce the exploitable attack surface, though this may impact legitimate contributor workflows and should be validated in a non-production environment first.