CVE-2026-90531: Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
Published Oct 13, 2026
·Updated
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
Affected Software
1 affected component
Adobe Adobe Experience Manager
Event History
Oct 13, 2026
CVE Published
via MITRE·07:39 PM
Data Sourced
via MITRE·07:39 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker needs low-privileged access to Adobe Experience Manager. Exploitation does not require user interaction.
2
What is the likely impact if exploitation succeeds?
A successful exploit could allow a low-privileged attacker to gain elevated access to internal resources. The vulnerability is rated critical with high confidentiality and integrity impact.