CVE-2026-105895
9.9CriticalPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-20
Impact
Authenticated remote attackers can execute arbitrary code with elevated privileges and take control of user sessions across security scopes without interaction. They need network access to the application and valid low-privileged credentials.
Root cause
Improper input validation in Adobe Experience Manager enables unauthorized code execution.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Consult Adobe security bulletin APSB26-152 to identify and deploy the fixed version or maintenance release; if updating immediately is not possible, restrict access to trusted internal IP addresses and audit low-privilege user accounts.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.