Act nowDisclosed

Advisory · CVE-2026-90532

Third unauthenticated authorization flaw in Adobe Experience Manager reaches 10.0

Adobe Experience Manager has a further incorrect authorization vulnerability in APSB26-152 that an unauthenticated attacker can use to execute arbitrary code. Adobe rates it CVSS 3.1 10.0.

Advisory published October 13, 2026Independent summary
Vendor
Adobe
Product
Adobe Experience Manager
Identifier / CWE
CVE-2026-90532
CWE-863
Action timing
Immediate
ELI5

Explain it like I’m five

Three broken locks in one bulletin is a pattern, not bad luck: anonymous requests keep reaching code-execution functions.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01No login needed

    An unauthenticated attacker reaches the affected AEM function.

  2. 02Authorization fails open

    The incorrect authorization check permits the request.

  3. 03Code executes

    The attacker runs arbitrary code in the application's context.

What happened

Adobe disclosed CVE-2026-90532 in bulletin APSB26-152 as an incorrect authorization vulnerability (CWE-863) in Adobe Experience Manager that could result in arbitrary code execution without authentication, alongside two similar 10.0 flaws in the same bulletin.

Adobe’s bulletin APSB26-152 covers Experience Manager 6.5 release lines and their hotfixes. Apply the hotfix Adobe lists for your exact 6.5 version rather than assuming one package fits all.

What to do

  1. Inventory every Adobe Experience Manager deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Adobe Experience Manager while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for anonymous access to restricted AEM paths and any content, user, or package changes without a matching authenticated session.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Treat the APSB26-152 authorization flaws as one incident class: hotfix urgently and audit for anonymous-use traces across all of them.