CVE-2026-90532

Adobe Experience Manager is affected by an incorrect authorization flaw (CWE-863) that can be exploited over the network with no privileges and no user interaction. Because authorization checks fail, an attacker can run arbitrary code in the context of the current user and may gain elevated access or control of that account or session; the CVSS scope is changed and confidentiality, integrity, and availability impacts are all rated high. The issue is scored CVSS 3.1 10.0 (critical). Specific affected version ranges were not included in the supplied data, so operators should confirm coverage against Adobe's bulletin. It is not listed in CISA KEV and no public proof-of-concept is known.

What to do: Apply Adobe's security update for Experience Manager as soon as the vendor bulletin identifies the fixed release. Until then, keep AEM author and administrative endpoints off the public internet, enforce least-privilege access, and review logs for unexpected authorization or code-execution activity.