Act nowDisclosed

Advisory · CVE-2026-48382

Authorization flaw in Adobe Experience Manager gives unauthenticated code execution

Adobe Experience Manager checks authorization incorrectly in a path an unauthenticated attacker can use to execute arbitrary code with changed scope. Adobe rates it CVSS 3.1 10.0.

Advisory published October 13, 2026Independent summary
Vendor
Adobe
Product
Adobe Experience Manager
Identifier / CWE
CVE-2026-48382
CWE-863
Action timing
Immediate
ELI5

Explain it like I’m five

A function that should have demanded credentials does not, and an anonymous visitor can reach code execution through it.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01No login needed

    An unauthenticated attacker reaches the affected AEM function.

  2. 02Authorization fails open

    The incorrect authorization check permits the request.

  3. 03Code executes

    The attacker runs arbitrary code in the application's context.

What happened

Adobe disclosed CVE-2026-48382 in bulletin APSB26-152: an incorrect authorization vulnerability (CWE-863) in Adobe Experience Manager that could result in arbitrary code execution without authentication.

Adobe’s bulletin APSB26-152 covers Experience Manager 6.5 release lines and their hotfixes. Apply the hotfix Adobe lists for your exact 6.5 version rather than assuming one package fits all.

What to do

  1. Inventory every Adobe Experience Manager deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Adobe Experience Manager while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for anonymous requests to authoring or administrative endpoints, new packages or users, and files changed outside deployments.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

A 10.0 unauthenticated code execution flaw in an internet-facing CMS is the definition of patch now and investigate after.