Adobe Experience Manager: Incorrect Authorization leads to code execution
Summary
Adobe Experience Manager 6.5 contains an Incorrect Authorization flaw (CWE-863) that can lead to arbitrary code execution in the context of the current user. A low-privileged account is enough, no user interaction is needed, and the scope is changed, so the impact can reach beyond the vulnerable component. Adobe is not aware of any exploitation in the wild.
Affected
- Adobe Experience Manager (AEM) 6.5: up to and including 6.5.25 (CNA record range: 0 to <= 6.5.25)
- AEM Cloud Service and AEM 6.5 LTS: listed as not affected for this CVE in Adobe's bulletin APSB26-189
Fixed in
- AEM 6.5: Service Pack 23, 24 and 25 - Cumulative Hotfix for GRANITE-75052 (per Adobe bulletin APSB26-189)
- Note: the CVE record names the hotfix GRANITE-75398 for 6.5.25. Verify the correct hotfix for your version in the bulletin before patching.
Workaround
- No vendor workaround known.
- Restrict access to AEM author and publish instances, limit dispatcher or proxy access to required paths, and review authorization on custom servlets and components until the hotfix is applied.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in this update.
- OffSeq: not known to be exploited. Strix: not listed in KEV.
- No public proof of concept found at the time of writing.
Our recommendation
- Identify self-hosted AEM 6.5 instances and confirm the exact service pack.
- Prioritise internet-facing instances and instances with self-registered or partner accounts.
- Apply the cumulative hotfix for GRANITE-75052 as described in APSB26-189 and verify the fix.
- Review logs for unusual actions by low-privileged accounts and monitor for new exploit reports.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-189 www.adobe.com
- Strix CVE page CVE-2026-119017 www.strix.ai
- OffSeq CVE page CVE-2026-119017 radar.offseq.com
- Adobe bulletin index for Experience Manager helpx.adobe.com
- Sibling CVE-2026-114371 (Strix) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:28.
Original description (NVD)
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.