CVE-2026-110083
7.1HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-89
Impact
A low-privileged authenticated attacker can bypass security controls to gain unauthorized read and limited write access to backend data. They only need network access to the application and standard user credentials.
Root cause
Improper neutralization of special elements in user-supplied input allows SQL injection within Adobe Experience Manager.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Fix & remediation
Apply the security patch detailed in Adobe advisory APSB26-152; if immediate patching is not possible, restrict application access to trusted users and monitor database query anomalies.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.