Six critical Adobe Experience Manager flaws allow remote code execution

What happened

NVD today, 13 October 2026, published six vulnerabilities in Adobe Experience Manager (AEM), Adobe's web content management platform. All six are rated critical and all of them can lead to arbitrary code execution.

The most serious are CVE-2026-48382, CVE-2026-48383 and CVE-2026-90532, which carry the maximum score of 10. They are incorrect authorization flaws that can be exploited over the network, without credentials and without any user interaction. An attacker could take control of accounts or sessions, and the impact can extend beyond the vulnerable component itself.

The remaining three, scored 9.9, require the attacker to hold a low-privileged account:

• CVE-2026-103848: operating system command injection.
• CVE-2026-105895: improper input validation.
• CVE-2026-75732: incorrect authorization, similar to the three CVSS 10 flaws.

Who is affected

Any organisation using Adobe Experience Manager is affected. Internet-facing instances, which typically host corporate websites and customer portals, are at greatest risk.

The available data does not specify which versions are affected or which versions fix the flaws. NVD links all six vulnerabilities to Adobe security bulletin APSB26-152, which is where this information should be confirmed.

Exploitation status

None of these vulnerabilities currently appears in CISA's KEV catalogue, so there is no confirmation of active exploitation.

That is no reason for complacency: three of the flaws have the highest possible severity and need no authentication, a combination that tends to draw attackers' attention quickly.

What to do

We recommend treating these vulnerabilities as a priority and taking the following steps:

• Inventory all Adobe Experience Manager instances and identify those reachable from the internet.
• Check Adobe bulletin APSB26-152 to confirm the affected versions and apply the updates it lists as soon as possible, starting with exposed systems.
• Until updates are in place, restrict access to the administration and authoring interfaces to internal networks or trusted addresses.
• Review accounts with access to AEM and remove any that are not needed, since three of the flaws only require a low-privileged account.
• Monitor logs for unusual activity, such as unauthorised access or unexpected commands being run on the servers.

Affected technologies

Vulnerabilities (6)