CVE-2026-48382

Adobe Experience Manager is affected by an incorrect authorization flaw (CWE-863) tracked as CVE-2026-48382. Adobe states that a remote attacker can exploit it without user interaction and without privileges, and that the security scope is changed. Successful exploitation can lead to arbitrary code execution in the context of the current user and may give elevated access or control over the victim's account or session, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 10.0). Affected version ranges were not included in the supplied data, so every AEM deployment should be checked against Adobe's advisory. It is not listed in CISA KEV and no public proof-of-concept is known.

What to do: Apply Adobe's security update for Experience Manager as soon as it is published for your deployment, and treat unpatched author and publish instances as critical. Until patched, restrict AEM to trusted networks, require authentication at the edge, and review authorization and session logs for unexpected privileged actions. Do not rely on a specific fixed version number until Adobe lists it in the advisory.