Adobe Experience Manager: Incorrect Authorization leading to code execution
Summary
Adobe Experience Manager (AEM) contains an Incorrect Authorization flaw (CWE-863, CVE-2026-48382) that can lead to arbitrary code execution in the context of the current user. An unauthenticated attacker with network access can exploit it without user interaction, and the impact can extend beyond the vulnerable component (scope changed), potentially gaining elevated access or control over a user account or session. The CVSS 3.1 base score is 10.0 (Critical). NVD analysis was still pending at the time of research.
Affected
- AEM as a Cloud Service: 2026.9.28187 and earlier
- AEM 6.5 LTS: Service Pack 3 and earlier
- AEM 6.5: 6.5.25 and earlier
Fixed in
- AEM as a Cloud Service: fixed in 2026.9.28386
- AEM 6.5 and 6.5 LTS: hotfixes for GRANITE-72352 (6.5 LTS SP1, SP2, SP3; 6.5.20 to 6.5.25). Whether this hotfix maps to CVE-2026-48382 is not confirmed; check the Adobe advisory.
- Hotfix download details: Unknown.
Workaround
- No vendor-published workaround is known. Patching is the only documented remedy.
- Interim measure (general practice, not a vendor statement): restrict external access to AEM author and administrative interfaces until patched.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in advisory APSB26-152.
- The Zero Day Initiative lists APSB26-152 with Exploited: No.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- No public proof-of-concept was found for CVE-2026-48382.
Our recommendation
- Identify all AEM instances, their versions, and whether they are internet-facing.
- Upgrade AEM as a Cloud Service to 2026.9.28386 or later. Apply the 6.5 and 6.5 LTS hotfixes after confirming the CVE mapping on the Adobe advisory page.
- Restrict external access to author and admin interfaces until patched, and review access logs for unexpected activity.
- Monitor the NVD entry and APSB26-152 for updates.
- Cloud Service customers should confirm with Adobe whether updates are applied automatically to their tenant.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-152 helpx.adobe.com
- Adobe Trust Center: APSB26-152 www.adobe.com
- Tenable Nessus plugin 365771 www.tenable.com
- Zero Day Initiative: October 2026 security update review www.zerodayinitiative.com
- Vulners: CVE-2026-48382 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:22.
Original description (NVD)
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.