CVE-2026-90532: Adobe Experience Manager | Incorrect Authorization (CWE-863)
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The provided vector indicates that exploitation is network-accessible, requires low attack complexity, and does not require privileges or user interaction. An unauthenticated remote attacker may therefore be able to exploit affected Adobe Experience Manager instances that are reachable over the network.
What is the likely impact if exploitation succeeds?
Successful exploitation could result in arbitrary code execution in the context of the current user. The issue may allow elevated access or control over the victim's account or session, with high impact to confidentiality, integrity, and availability.
Does this require a user to open a file, click a link, or otherwise interact with an attacker?
No. The advisory data states that exploitation does not require user interaction.