Adobe Experience Manager OS Command Injection Lets Low-Privileged Users Run Code Remotely
Critical flaw in Adobe Experience Manager allows low-privileged attackers to execute arbitrary code without user interaction, affecting LTS and standard releases.
Key points
- CVE-2026-103848 carries a CVSS score of 9.9, rated critical by the NVD.
- The flaw is an OS command injection issue classified under CWE-78.
- Affected products include Adobe Experience Manager 6.5 LTS up to SP3 and 6.5 up to 6.5.25.
Adobe Experience Manager contains a critical OS command injection vulnerability that permits arbitrary code execution. The flaw stems from improper neutralisation of special elements within operating system commands. According to the National Vulnerability Database, this issue allows a low-privileged attacker to run code in the context of the current user. The vulnerability does not require any interaction from the user to be exploited.
Root cause
The underlying weakness is identified as CWE-78, Improper Neutralisation of Special Elements used in an OS Command. This means the application fails to properly filter or sanitise input before passing it to the underlying operating system. When an attacker supplies crafted input, the system interprets specific characters as command separators or arguments. This misinterpretation allows the injection of unintended commands into the execution stream.
Attack path
An attacker needs only low-level privileges to exploit this issue. They do not need to trick a user into clicking a link or opening a file. The exploitation process is direct, targeting the application’s handling of command inputs. Once the crafted input reaches the vulnerable function, the operating system executes the injected commands. The resulting actions occur within the context of the user running the service.
Affected versions
The vulnerability impacts the following software releases:
- Adobe Experience Manager 6.5 LTS up to 6.5 LTS SP3
- Adobe Experience Manager 6.5 up to 6.5.25
Organisations running these specific versions are exposed to the risk. Later builds or different major versions are not listed as affected in this record. Teams must verify their current version against this list.
Mitigation
- Verify the installed version of Adobe Experience Manager immediately.
- Compare your version against the affected list provided in this report.
- If running an affected version, contact Adobe for patching guidance.
- Restrict network access to the application to reduce exposure until a fix is confirmed.
Signals worth monitoring
Security operations teams should examine application logs for unusual command-line arguments or syntax errors. Look for unexpected process spawning or child processes with strange parent-child relationships. Check for outbound connections from the application server to unfamiliar IP addresses. Review authentication logs for actions performed by low-privileged accounts that seem out of scope. Investigate any sudden changes in file permissions or new executable files in temporary directories.
What to do and how to stay safe: Adobe
- Audit all servers running Adobe Experience Manager to confirm version numbers.
- Monitor network traffic from these hosts for anomalous outbound connections.
- Review system logs for signs of unexpected command execution or process creation.
- Apply the latest vendor updates once the vendor provides an update.
Step-by-step guide: Out-of-band patches: what small businesses need to know
General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability require remote access?
The source material states exploitation does not require user interaction, but does not specify if remote network access is needed.
What is the severity rating?
The NVD rates CVE-2026-103848 as critical with a CVSS score of 9.9.
Is there a confirmed fix available?
No fix has been confirmed yet in the provided source material.
