Adobe Experience Manager: XXE vulnerability enables privilege escalation
Summary
Adobe Experience Manager (AEM) contains an XML External Entity (XXE) vulnerability (CWE-611) that can lead to privilege escalation. An attacker with a low-privileged account can reach internal resources without user interaction, and the scope changes. The CVSS score is 9.6 (Critical), and CISA SSVC rates the technical impact as total while the vulnerability is not automatable.
Affected
- Adobe Experience Manager as a Cloud Service: 0 to 2026.9.28187
- Adobe Experience Manager 6.5 LTS: 0 to 6.5 LTS SP3
- Adobe Experience Manager 6.5: 0 to 6.5.25
Fixed in
- Adobe Experience Manager as a Cloud Service: 2026.9.28386 or later
- Adobe Experience Manager 6.5 LTS: hotfix for GRANITE-71772 (6.5 LTS SP1, SP2 or SP3)
- Adobe Experience Manager 6.5: hotfix for GRANITE-71772 (6.5.22, 6.5.23, 6.5.24 or 6.5.25)
Workaround
Unknown. No workaround is documented; apply the fix from Adobe security bulletin APSB26-152.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in this update.
- Tenable lists no known exploits, and no public proof of concept was found in the research.
- CISA SSVC: exploitation none, not automatable.
Our recommendation
- Confirm whether you run AEM as a Cloud Service or 6.5 / 6.5 LTS and which version is installed.
- Apply the fix from APSB26-152 as soon as possible, and verify the hotfix mapping against the advisory's vulnerability table.
- Patch the whole bulletin, not only this CVE, because it includes other critical issues such as CVE-2026-90532.
- Review accounts with low privileges and restrict outbound network access from AEM hosts where possible.
- Monitor the advisory for updates on exploitation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-152 helpx.adobe.com
- Adobe APSB26-152 (Trust page) www.adobe.com
- Tenable plugin 365771 www.tenable.com
- Zero Day Initiative October 2026 review www.zerodayinitiative.com
- HKCERT Adobe October 2026 bulletin www.hkcert.org
- Vulners CVE record CVE-2026-90531 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:56.
Original description (NVD)
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.