Key points
- CVE-2026-90532 is rated CVSS 10.0 Critical by the National Vulnerability Database.
- The flaw affects Adobe Experience Manager as a Cloud Service up to 2026.9.28187.
- On-premises versions 6.5 and 6.5 LTS are vulnerable up to SP3 and 6.5.25.
Adobe Experience Manager installations require immediate attention due to a critical authorization flaw identified as CVE-2026-90532. The National Vulnerability Database rates this issue at 10.0, the highest possible severity. The vulnerability exists in Adobe Experience Manager as a Cloud Service versions prior to 2026.9.28187. It also affects Adobe Experience Manager 6.5 LTS versions up to Service Pack 3 and standard 6.5 versions up to 6.5.25.
In plain English
This security issue stems from incorrect authorization controls within the software. An attacker can exploit this flaw to execute arbitrary code on the affected system. This execution happens in the context of the current user, which may allow the attacker to gain elevated access or control over a victim's account or session. The most dangerous aspect of this vulnerability is that it does not require any interaction from a user to be exploited.
The background
The flaw is classified under CWE-863, which relates to incorrect authorization. According to the NVD record, the scope of the vulnerability is changed, indicating a significant impact on the system's integrity. The description notes that exploitation could result in arbitrary code execution. This means an attacker could run their own programs on the server, potentially taking over the system or stealing data. No user action, such as clicking a link, is needed for the attack to succeed.
What changes now
Organizations running these specific versions of Adobe Experience Manager must verify their current build numbers immediately. If your version is older than the thresholds listed above, your system is exposed. The NVD record confirms the existence of the vulnerability and its severity but does not explicitly detail a new patch release in this specific text. Teams should check Adobe's official security advisories for the latest update instructions. Until a fix is applied, the risk of remote code execution remains high for unpatched systems.
Who needs to act first
Teams usually prioritize systems exposed to the internet or internal networks with high-value data. Check whether your AEM instances are publicly accessible, as these face the greatest immediate risk. Before applying any updates, back up your current configuration and content to prevent data loss. Test the update in a staging environment first to ensure it does not break existing workflows. If a patch is not yet available, consider isolating the affected systems from untrusted networks to reduce exposure while monitoring for official vendor guidance.
What to do and how to stay safe: Adobe Experience Manager
- Identify all servers running Adobe Experience Manager and compare their version numbers against the vulnerable list provided by Adobe.
- Review access logs for unusual activity that might indicate exploitation of the authorization flaw.
- Ensure that network segmentation limits access to AEM servers to only necessary internal services.
- Wait for the vendor to provide a confirmed update before applying changes to production environments.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Adobe Experience Manager are affected by CVE-2026-90532?
Cloud Service versions up to 2026.9.28187, 6.5 LTS up to SP3, and 6.5 up to 6.5.25 are affected.
Does this vulnerability require user interaction to exploit?
No, the NVD record states that exploitation of this issue does not require user interaction.
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-90532 as CVSS 10.0 Critical.
