Adobe Experience Manager EUVD-2026-74243

Requires a valid low-privileged authenticated account on an affected AEM instance (CVSS PR:L) that is network-reachable (AV:N); no user interaction and no special client-side conditions are needed (UI:N, AC:L). Limiting factors: the attacker must already hold some credential/session on the target - this is not a pre-authentication flaw - and only the enumerated builds are affected (AEM 6.5 ≤6.5.24, AEMaaCS ≤2026.7.0, AEM 6.5 LTS ≤SP2). Exposure is greatest on author instances or multi-user/multi-tenant deployments where low-privileged accounts are common; hardened publish tiers with no low-priv accounts and no reachable authoring endpoints materially reduce risk.

The signals point to a genuine high priority for internet-exposed or multi-tenant AEM authoring/publish deployments: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, C:H/I:H/A:H = 9.9) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, with a scope change that magnifies blast radius. Only a valid low-privileged account is required - realistic in AEM environments that provision many author or limited-service accounts - so any operator running an affected build should treat this as urgent and patch on Adobe's schedule rather than waiting. Tempering the raw score: no EPSS probability, CISA KEV entry, or public proof-of-concept is present in the provided data, so there is no evidence of active exploitation yet, and the 'context of the current user' phrasing suggests the code-execution primitive may be bounded by the compromised account's rights before the scope change amplifies it. The 9.9 is vendor-assigned (Adobe PSIRT) and not independently reproducible from the description alone.

An attacker obtains or is issued a low-privileged AEM account (e.g., a basic author or a leaked service credential), then sends crafted requests to the vulnerable authorization-checked endpoint over the network with no user interaction. The incorrect authorization grants an operation that yields code execution, and the changed scope lets the attacker pivot to elevated access or control of another user's account or session. No public PoC is identified at time of analysis.