CVE-2026-94243

Apache Sling Security Bundle before version 1.3.2 contains an origin validation error (CWE-346) in its ReferrerFilter, the component that guards against cross-site request forgery by checking the Referer/Origin header on state-changing requests. The filter accepts 'weaker-than-origin' evidence, meaning a request whose referrer does not strictly match the target origin can still pass the CSRF check. An attacker who lures an authenticated user of a Sling-based application (Sling underpins Adobe Experience Manager) to a malicious web page could silently submit forged POST requests that pass the filter and perform actions as the victim, such as modifying or publishing content, changing configurations, or creating users. Any deployment running the Sling Security Bundle older than 1.3.2 is affected; exploitation status is currently unknown, with no public proof of concept and no listing in the CISA Known Exploited Vulnerabilities catalog. The issue is fixed in version 1.3.2.

What to do: Upgrade the Apache Sling Security Bundle to version 1.3.2 or later. If you run Adobe Experience Manager or another product that embeds Sling, apply the vendor's security update that includes the fixed bundle rather than swapping the OSGi bundle yourself. As interim mitigations, enforce strict Referer/Origin allowlisting at a reverse proxy or WAF, set SameSite cookies, and restrict administrative consoles to trusted networks or VPN.