Description
Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Published: 2026-10-13
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a CWE-20 Improper Input Validation flaw in Adobe Experience Manager that allows attackers with high privileges to execute arbitrary code in the current user context. Because the flaw can be triggered without user interaction and changes the scope of the affected code, it enables the compromise of the entire system if exploited.

Affected Systems

Adobe Experience Manager 6.5, Adobe Experience Manager 6.5 LTS, and Adobe Experience Manager as a Cloud Service are affected.

Risk and Exploitability

With a CVSS score of 9.1 the risk is critical. The EPSS score is not available, but the lack of user interaction requirement suggests potential remote exploitation if an attacker can reach an account with high privileges. The vulnerability is not listed in CISA's KEV catalog yet, yet its severity warrants immediate attention.

Generated by OpenCVE AI on October 13, 2026 at 23:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy the official Adobe patch for the affected Experience Manager versions as soon as it becomes available.
  • Implement rigorous input validation and sanitization on all user-supplied data to prevent the CWE-20 flaw from being exploited.
  • Restrict the privilege set of users who have access to the vulnerable component; if possible, lock down high‑privilege accounts and enforce least privilege.
  • Monitor system logs and audit trails for anomalous input patterns or attempts to exploit the input validation flaw.

Generated by OpenCVE AI on October 13, 2026 at 23:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*
cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*
cpe:2.3:a:adobe:experience_manager:*:*:*:*:lts:*:*:*

Fri, 16 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe adobe Experience Manager
Adobe experience Manager
Adobe experience Manager Cloud Service
Vendors & Products Adobe
Adobe adobe Experience Manager
Adobe experience Manager
Adobe experience Manager Cloud Service

Wed, 14 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Description Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Title Adobe Experience Manager | Improper Input Validation (CWE-20)
Weaknesses CWE-20
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Adobe Adobe Experience Manager Experience Manager Experience Manager Cloud Service
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-10-14T10:51:03.049Z

Reserved: 2026-10-07T00:39:38.326Z

Link: CVE-2026-106626

cve-icon Vulnrichment

Updated: 2026-10-14T10:40:56.711Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T20:17:16.270

Modified: 2026-10-26T15:12:15.240

Link: CVE-2026-106626

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T14:11:08Z

Weaknesses
  • CWE-20

    Improper Input Validation