Description
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.
Published: 2026-06-09
Score: 3.5 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability stems from improper input validation that permits a low‑privileged attacker to bypass security measures and gain write rights to application content. The flaw allows crafted data to circumvent standard safeguards, enabling an attacker to modify or inject data without having system‑wide control.

Affected Systems

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and all earlier releases are affected; the product is listed by the CNA as Adobe Experience Manager.

Risk and Exploitability

The CVSS score of 3.5 classifies the problem as low severity and the EPSS score is not available, with no listing in the CISA KEV catalogue. Exploitation requires user interaction, such as opening a malicious URL or interacting with a compromised web page, limiting the attack likelihood to environments where users encounter such content.

Generated by OpenCVE AI on June 9, 2026 at 20:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Adobe Experience Manager patch that upgrades the system beyond version 6.5.24.
  • Restrict write permissions for users who do not require them, ensuring only authorized roles can modify content.
  • Educate users to avoid clicking unknown links and to keep browser security settings enabled to detect malicious URLs.
  • Monitor access logs for unusual write attempts to detect potential exploitation.

Generated by OpenCVE AI on June 9, 2026 at 20:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 10 Jun 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe adobe Experience Manager
Vendors & Products Adobe
Adobe adobe Experience Manager

Tue, 09 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 09 Jun 2026 17:15:00 +0000

Type Values Removed Values Added
Description Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.
Title Adobe Experience Manager | Improper Input Validation (CWE-20)
Weaknesses CWE-20
References
Metrics cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N'}

Subscriptions

Adobe Adobe Experience Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-06-09T20:10:15.681Z

Reserved: 2026-05-21T15:28:38.134Z

Link: CVE-2026-48289

cve-icon Vulnrichment

Updated: 2026-06-09T20:10:12.204Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-06-09T17:17:43.860

Modified: 2026-06-09T19:30:24.713

Link: CVE-2026-48289

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-10T00:00:10Z

Weaknesses