Adobe Experience Manager: Incorrect Authorization enables code execution
Summary
Adobe Experience Manager (AEM) is affected by an Incorrect Authorization flaw (CWE-863) that can lead to arbitrary code execution in the context of the current user. According to the CNA record, no privileges and no user interaction are required and the scope is changed, so an attacker with network access could potentially gain elevated access or control over the victim's account or session. The official CVSS score is 10.0 (Critical), but research notes found a conflicting Adobe listing with CVSS 7.1 and low privileges required, so the Adobe advisory must be checked.
Affected
- Adobe Experience Manager as a Cloud Service: 0 to 2026.9.28187
- Adobe Experience Manager 6.5 LTS: 0 to 6.5 LTS SP3
- Adobe Experience Manager 6.5: 0 to 6.5.25
Fixed in
- Adobe Experience Manager as a Cloud Service: 2026.9.28386
- Adobe Experience Manager 6.5 LTS SP1, SP2, SP3: Hotfix GRANITE-72352
- Adobe Experience Manager 6.5.20 to 6.5.25: Hotfix GRANITE-72352
- The mapping of the hotfix to CVE-2026-48383 should be confirmed in the Adobe advisory.
Workaround
Unknown. No vendor workaround was identified in the sources.
Exploitation
- Adobe is not aware of any exploits in the wild for issues in this bulletin.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
- No public proof of concept specific to CVE-2026-48383 was found.
Our recommendation
- Identify all AEM instances (author, publish, Cloud Service, 6.5) and check whether any are reachable from the internet.
- Confirm the current Adobe advisory APSB26-152, including severity and the hotfix mapping.
- Update Cloud Service instances to 2026.9.28386 or later and apply the GRANITE-72352 hotfix on 6.5 systems.
- Review logs of exposed instances for unusual authorisation or code execution activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-152 (helpx) helpx.adobe.com
- Adobe Security Bulletin APSB26-152 (adobe.com/trust) www.adobe.com
- NVD-based CVE data (vulners) vulners.com
- CNA summary (Strix) www.strix.ai
- Tenable plugin 365771 www.tenable.com
- ZDI October 2026 security update review www.zerodayinitiative.com
- HKCERT Adobe monthly security update October 2026 www.hkcert.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:21.
Original description (NVD)
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.