CVE-2026-105895: Adobe Experience Manager | Improper Input Validation (CWE-20)
Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
Who is most exposed to exploitation?
Adobe Experience Manager instances accessible over the network are in scope. Exploitation requires low-level privileges, so environments where an attacker can obtain a minimally privileged account or session should be prioritized.
Does exploitation require a victim to click or approve anything?
No. The vulnerability can be exploited without user interaction.
What could an attacker achieve after successful exploitation?
An attacker could execute arbitrary code in the context of the current user. Because the vulnerability has changed scope, this may allow elevated access or control over the victim's account or session, with high impact to confidentiality, integrity, and availability.