CVE-2026-90531
9.6CriticalPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-611
Impact
An authenticated low-privileged user can escalate privileges and access internal resources across system boundaries without user interaction. Network access to the Adobe Experience Manager instance and a valid low-privilege account are required.
Root cause
The application fails to restrict XML External Entity (XXE) references during XML parsing.
Affected systems
Adobe Experience Manager (exact versions not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Fix & remediation
Upgrade Adobe Experience Manager to the patched version referenced in bulletin APSB26-152; no interim mitigation is documented in the advisory.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.