Adobe Experience Manager Incorrect Authorisation Flaw Permits Code Execution

Adobe Experience Manager contains an incorrect authorisation vulnerability that permits arbitrary code execution. This flaw impacts specific versions of the content management system, allowing attackers to run code within the context of the current user. The vulnerability could lead to gaining elevated access or control over the victim's account or session.

Root cause

The National Vulnerability Database describes the issue as an incorrect authorisation vulnerability. This weakness is classified under CWE-863. The flaw allows actions to be performed without proper permission checks, resulting in the ability to execute arbitrary code. The scope of the vulnerability is noted as changed, indicating a transition from unauthenticated to authenticated or vice versa in its impact assessment.

Attack path

Exploitation of this issue does not require user interaction. An attacker can leverage the incorrect authorisation to execute code in the context of the current user. This could potentially result in gaining elevated access or taking control of the victim's account or session. The lack of interaction requirements means the flaw can be triggered without direct engagement from a targeted user.

Affected versions

• Adobe Experience Manager 6.5 LTS up to 6.5 LTS SP3
• Adobe Experience Manager 6.5 up to 6.5.25

Mitigation

• Verify if your AEM instances fall within the affected version ranges listed above.
• Review access controls and authorisation settings for any anomalies.
• Monitor logs for unusual code execution patterns or privilege escalations.
• Await official patches or guidance from Adobe for remediation.

Signals worth monitoring

Teams usually inspect web server logs for unexpected POST requests to sensitive endpoints. Check for anomalous process spawns or new user creation events that lack corresponding administrative actions. Look for outbound connections to unfamiliar IP addresses, which might indicate command-and-control traffic. Review authentication logs for successful logins followed by immediate privilege escalation attempts. Monitor for unusual file system changes or new executable files appearing in temporary directories.

What to do and how to stay safe: Adobe Experience Manager

• Audit your Adobe Experience Manager installations to confirm version status against the affected list.
• Implement strict network segmentation to limit lateral movement if a breach occurs.
• Enable detailed logging on web servers and application layers to capture exploitation attempts.
• Prepare incident response playbooks focusing on credential compromise and code execution scenarios.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-75732?

The CVSS score is 9.9, which is rated as Critical.

Which versions of Adobe Experience Manager are affected?

AEM 6.5 LTS up to SP3 and standard 6.5 up to 6.5.25 are affected.

Does exploiting this vulnerability require user interaction?

No, exploitation of this issue does not require user interaction.