Adobe Experience Manager: Improper input validation leading to code execution
Summary
Adobe Experience Manager (AEM) contains an improper input validation flaw (CWE-20) that can lead to arbitrary code execution in the context of the current user. An attacker with low privileges and no user interaction can potentially gain elevated access or control over the victim's account or session, and the scope change means the impact can extend beyond the vulnerable component. The CVSS base score is 9.9 (Critical). Adobe reports no known exploitation and no public proof of concept was found.
Affected
- Adobe Experience Manager 6.5: versions up to and including 6.5.25 (CNA record)
- Adobe bulletin APSB26-152 also lists AEM Cloud Service 2026.9.28187 and earlier, AEM 6.5 Service Pack 25 and earlier, and AEM 6.5 LTS Service Pack 3 and earlier
- Exact per-CVE scope not yet confirmed by Adobe; sources disagree
Fixed in
- AEM Cloud Service: 2026.9.28386 or later
- AEM 6.5 / 6.5 LTS: hotfix GRANITE-72352 per Adobe bulletin; hotfix-to-CVE mapping must be confirmed on APSB26-152
- Hotfixes for AEM 6.5 CQ-4364862 are listed as unaffected for 6.5.23, 6.5.24 and 6.5.25 in the CNA record
Workaround
Unknown.
Exploitation
- Adobe: not aware of any exploits in the wild
- ZDI (October 2026): not exploited
- Tenable: no known exploits
- CISA SSVC: exploitation none, not automatable, total technical impact
- No public proof of concept found for this CVE
Our recommendation
- Identify all AEM instances (Cloud Service, 6.5, 6.5 LTS) and their exact versions
- Apply the Adobe fixes from APSB26-152 as soon as possible; confirm the hotfix mapping for on-premises instances with Adobe support
- Review exposure of publish instances and accounts with low privileges, including partner, agency and contractor access
- Monitor Adobe's advisory and CISA KEV for changes in exploitation status
- If AEM is run by an agency or hosting provider, ask them for confirmation of patch status
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe security bulletin APSB26-152 www.adobe.com
- Adobe helpx advisory APSB26-152 helpx.adobe.com
- Tenable plugin 365771 www.tenable.com
- Zero Day Initiative October 2026 security update review www.zerodayinitiative.com
- CVE record copy (Vulners) vulners.com
- HKCERT Adobe monthly security update October 2026 www.hkcert.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:24.
Original description (NVD)
Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.