Advisory · CVE-2026-105895
Input validation flaw in Adobe Experience Manager leads to code execution
Adobe Experience Manager improperly validates input in a path a low-privileged attacker can use to execute arbitrary code with changed scope. Adobe rates it CVSS 3.1 9.9.
- Vendor
- Adobe
- Product
- Adobe Experience Manager
- Identifier / CWE
- CVE-2026-105895
CWE-20 - Action timing
- Immediate
Explain it like I’m five
AEM accepts input it should have rejected, and a low-privilege user can shape that input until the server runs it as code.
- 01Low-privilege access
An attacker with a low-privilege AEM account reaches the vulnerable function.
- 02Input accepted unchecked
The attacker submits input AEM does not properly validate.
- 03Code executes
The input is executed in the context of the current user and application.
What happened
Adobe disclosed CVE-2026-105895 in bulletin APSB26-152: an improper input validation vulnerability (CWE-20) in Adobe Experience Manager that could result in arbitrary code execution for a low-privileged attacker.
Adobe’s bulletin APSB26-152 covers Experience Manager 6.5 release lines and their hotfixes. Apply the hotfix Adobe lists for your exact 6.5 version rather than assuming one package fits all.
What to do
- Inventory every Adobe Experience Manager deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Adobe Experience Manager while remediation is underway, especially for internet-facing instances.
- Review application and server logs for content or component changes by low-privilege accounts outside normal publishing, and AEM error logs with malformed requests.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Pair this with the other AEM flaws in APSB26-152: one hotfix cycle, one review of who holds AEM accounts.