CVE-2026-48383
10.0CriticalPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-863
Impact
Unauthenticated remote attackers can execute arbitrary code with elevated access over Adobe Experience Manager sessions and systems. They need only network access to an exposed AEM instance, requiring zero user interaction.
Root cause
An incorrect authorization flaw fails to properly validate permissions, allowing unauthorized callers to bypass access controls.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade Adobe Experience Manager to the patched version detailed in bulletin APSB26-152; if patching cannot occur immediately, restrict network access to the AEM author and publish instances to trusted internal traffic only.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.