Act nowDisclosed

Advisory · CVE-2026-48383

Second unauthenticated authorization flaw in Adobe Experience Manager, also 10.0

Adobe Experience Manager has another incorrect authorization vulnerability in the same bulletin that can be used by an unauthenticated attacker to execute arbitrary code. Adobe rates it CVSS 3.1 10.0.

Advisory published October 13, 2026Independent summary
Vendor
Adobe
Product
Adobe Experience Manager
Identifier / CWE
CVE-2026-48383
CWE-863
Action timing
Immediate
ELI5

Explain it like I’m five

Another AEM door with a broken lock, on a different handle: anonymous requests reach functions that were never meant for them.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01No login needed

    An unauthenticated attacker reaches the affected AEM function.

  2. 02Authorization fails open

    The incorrect authorization check permits the request.

  3. 03Code executes

    The attacker runs arbitrary code in the application's context.

What happened

Adobe disclosed CVE-2026-48383 in bulletin APSB26-152 as a distinct incorrect authorization vulnerability (CWE-863) in Adobe Experience Manager, alongside CVE-2026-48382.

Adobe’s bulletin APSB26-152 covers Experience Manager 6.5 release lines and their hotfixes. Apply the hotfix Adobe lists for your exact 6.5 version rather than assuming one package fits all.

What to do

  1. Inventory every Adobe Experience Manager deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Adobe Experience Manager while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for anonymous hits on restricted endpoints and content or configuration changes with no matching login.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Apply the APSB26-152 hotfix as one urgent change covering both 10.0 flaws, then hunt for signs of anonymous access having been used.