CVE-2026-106626
9.1CriticalPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-20
Impact
High-privileged attackers can achieve arbitrary code execution and escape to the underlying host or other components. They only need network access and administrative credentials to the Adobe Experience Manager instance.
Root cause
Improper input validation allows high-privileged input to be processed unsafely.
Affected systems
Adobe Experience Manager (specific versions not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade Adobe Experience Manager to the patched version specified in bulletin APSB26-152; if immediate patching is not possible, restrict administrative access to trusted internal IP addresses and audit admin user accounts.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.