Adobe Experience Manager: OS command injection leading to code execution
Summary
Adobe Experience Manager (AEM) 6.5 LTS and the 6.5 line are affected by an OS command injection vulnerability (CWE-78). An authenticated attacker with low privileges can execute arbitrary code in the context of the current user over the network, without user interaction, and the scope is changed so the impact can extend beyond AEM. Adobe has released fixes and hotfixes in security bulletin APSB26-152.
Affected
- Adobe Experience Manager 6.5 LTS: 0 to 6.5 LTS SP3 (per CNA record)
- Adobe Experience Manager 6.5: 0 to 6.5.25 (per CNA record; upper bound to be confirmed against Adobe's table)
- Newer AEM lines: unknown, check APSB26-152
Fixed in
- 6.5 LTS SP1, SP2, SP3: hotfix for NPR-44637
- 6.5.20 to 6.5.25: hotfix for NPR-44636
- Verify the exact mapping in Adobe's advisory APSB26-152 before rollout
Workaround
Unknown. No vendor-documented workaround found; patching is the primary remediation.
Exploitation
- Adobe states it is not aware of any exploits in the wild for the issues in this update.
- One aggregator lists KEV: No; the CISA KEV catalogue was not checked directly.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found; absence not confirmed.
Our recommendation
- Identify all AEM instances and their exact versions, and determine which are in the affected range.
- Apply the APSB26-152 fixes or hotfixes per Adobe's table, starting with internet-facing publish instances.
- Review AEM accounts and roles; remove unneeded low-privilege accounts and disable self-registration.
- Check logs on AEM hosts for unusual process execution or command-related errors.
- Re-check the advisory and the KEV catalogue for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe security bulletin APSB26-152 helpx.adobe.com
- Adobe APSB26-152 (trust page) www.adobe.com
- Zero Day Initiative: October 2026 security update review www.zerodayinitiative.com
- Tenable plugin 365771 www.tenable.com
- Strix AI: CVE-2026-103848 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:24.
Original description (NVD)
Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.