Act nowDisclosed

Advisory · CVE-2026-75732

Authorization flaw in Adobe Experience Manager escalates a low-privilege account to code execution

Adobe Experience Manager has an incorrect authorization vulnerability a low-privileged attacker can use to execute arbitrary code with changed scope. Adobe rates it CVSS 3.1 9.9.

Advisory published October 13, 2026Independent summary
Vendor
Adobe
Product
Adobe Experience Manager
Identifier / CWE
CVE-2026-75732
CWE-863
Action timing
Immediate
ELI5

Explain it like I’m five

A small account is handed big permissions by mistake, and the mistake is big enough to run code on the server.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Low-privilege access

    An attacker with a low-privilege AEM account reaches the vulnerable function.

  2. 02Authorization misjudged

    AEM treats the request as permitted when it should not be.

  3. 03Code executes

    The attacker runs arbitrary code in the application's context.

What happened

Adobe disclosed CVE-2026-75732 in bulletin APSB26-152: an incorrect authorization vulnerability (CWE-863) in Adobe Experience Manager that could result in arbitrary code execution for a low-privileged attacker.

Adobe’s bulletin APSB26-152 covers Experience Manager 6.5 release lines and their hotfixes. Apply the hotfix Adobe lists for your exact 6.5 version rather than assuming one package fits all.

What to do

  1. Inventory every Adobe Experience Manager deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Adobe Experience Manager while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for low-privilege accounts invoking administrative functions and content changes outside their role.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Authorization flaws multiply the value of every weak AEM password. Hotfix, then trim and review the account list.