CVE-2026-48383
Incorrect authorization RCE in Adobe Experience Manager
- CVSS 3.1
- 10.0 critical
- EPSS
- —
- Published
- ·
- Modified
Adobe Experience Manager has an incorrect authorization flaw (CWE-863) that Adobe rates critical (CVSS 3.1 10.0). A remote attacker can exploit it over the network with no privileges and no user interaction; scope is changed. Successful exploitation can lead to arbitrary code execution in the context of the current user and may give elevated access or control of the victim account or session. Affected version ranges are not stated in the provided data. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Apply the Adobe security update for Experience Manager as soon as it is published for your deployment, and until then restrict network access to AEM author and publish endpoints. Review authorization rules and session controls, and watch logs for unauthenticated requests that change privileges or execute unexpected actions.
| Product | Affected |
|---|---|
| Adobe Experience Manager | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
- Vendors
- adobe
- Products
- experience manager
- Weakness
- CWE-863
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
In the news
0 storiesNo ingested article mentions this CVE yet.