AI and data stack advisories

Severe, 6 weeks977Projects326

977 severe, 6 weeks · 326 projects

AdobeCVE-2026-90532

Adobe Experience Manager: improper authorization

Adobe

CVE-2026-90532 · Published Oct 13, 2026 · updated Oct 29, 2026

Critical10.0
No fix yet
Adobe advisory

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

Affected versions

PackageAffectedFixed in
Adobe Experience Manager 6.5
Product
<= 6.5.25No fix yet
Adobe Experience Manager 6.5 LTS
Product
<= 6.5 LTS SP3No fix yet
Adobe Experience Manager as a Cloud Service
Product
<= 2026.9.28187No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-863

More Adobe advisories

All Adobe