Adobe Experience Manager: Incorrect authorization allows code execution
Summary
Adobe Experience Manager (AEM) contains an Incorrect Authorization flaw (CWE-863) that can lead to arbitrary code execution in the context of the current user. An attacker with low privileges can exploit it without user interaction, and the scope is changed (CVSS 3.1 9.9, critical). Adobe states it is not aware of any exploits in the wild.
Affected
- AEM as a Cloud Service: 2026.10.29023 and earlier
- AEM 6.5: Service Pack 25 and earlier
- AEM 6.5 LTS: Service Pack 3 and earlier
- Note: the CNA record lists 6.5 LTS SP3 as affected, while Adobe's earlier APSB26-98 lists it as a fixed release. Verify against APSB26-189.
Fixed in
- AEM as a Cloud Service: 2026.10.29251
- AEM 6.5 (SP23 to SP25): Cumulative Hotfix for GRANITE-75052
- AEM 6.5 LTS (SP1 to SP3): Cumulative Hotfix for GRANITE-75052
- The CNA record names GRANITE-75398 for the 6.5 hotfix. Confirm the correct hotfix in the advisory.
Workaround
Unknown. No vendor workaround is documented in the reviewed sources. Until patched, restrict access to AEM author and publish instances and limit low-privileged accounts.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in APSB26-189.
- No public proof of concept was found at the time of publication.
- The reviewed sources do not list this CVE as known exploited.
Our recommendation
- Identify all AEM instances, including Cloud Service and on-premises 6.5 and 6.5 LTS.
- Update Cloud Service to 2026.10.29251 and apply the GRANITE-75052 hotfix on-premises, after confirming the details in APSB26-189.
- Until patched, restrict access to author and publish instances and review low-privileged and self-registered accounts.
- Monitor for signs of exploitation and re-check the advisory and exploitation status regularly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-189 www.adobe.com
- strix.ai CVE-2026-114371 www.strix.ai
- Offseq threat radar CVE-2026-114371 radar.offseq.com
- Adobe Security Bulletin APSB26-98 helpx.adobe.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:32.
Original description (NVD)
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.