Adobe Security Bulletin

Last updated on Oct 13, 2026

Security update available for Adobe Experience Manager | APSB26-152

Bulletin ID

Date published

Priority

APSB26-152

October 13, 2026

style

grid width 12

Summary

Adobe has released a priority 2 security update for Adobe Experience Manager. This update addresses vulnerabilities rated critical and medium that could result in arbitrary code execution, security feature bypass, and privilege escalation.

Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.

Affected Versions

Product

Version

Platform

Adobe Experience Manager (AEM) Cloud Service (CS)

2026.9.28187 and earlier

All

Adobe Experience Manager (AEM) 6.5

Service Pack 25 and earlier

All

Adobe Experience Manager (AEM) 6.5 LTS

Service Pack 3 and earlier

All

style

grid width 12

Solution

Adobe categorizes this update with the following priority rating and recommends users update their installation to the newest version:

Product

Updated version

Platform

Priority rating

Installation instructions

Adobe Experience Manager (AEM) Cloud Service (CS)

2026.9.28386

All

Release Notes

Adobe Experience Manager (AEM) 6.5

Service Pack 25 - Hotfix for GRANITE-72352

Service Pack 25 - Hotfix for SITES-49894 + SITES-49335 + SITES-48207

Service Pack 25 - Hotfix for GRANITE-71772

Service Pack 25 - Hotfix for GRANITE-75052

Service Pack 25- Hotfix for CQ-4364862

Service Pack 25- Hotfix for GRANITE-71379

Service Pack 25- Hotfix for NPR-44636

All

Service Pack 25 - Hotfix for GRANITE-72352

Service Pack 25 - Hotfix for SITES-49894 + SITES-49335 + SITES-48207

Service Pack 25 - Hotfix for GRANITE-71772

Service Pack 25 - Hotfix for GRANITE-75052

Service Pack 25- Hotfix for CQ-4364862

Service Pack 25- Hotfix for GRANITE-71379

Service Pack 25- Hotfix for NPR-44636

Adobe Experience Manager (AEM) 6.5 LTS

Service Pack 3 - Hotfix for GRANITE-72352

Service Pack 3 - Hotfix for SITES-49893 + SITES-49334 + SITES-48208

Service Pack 3 - Hotfix for GRANITE-71772

Service Pack 3 - Hotfix for GRANITE-75052

Service Pack 3 - Hotfix for GRANITE-71379

Service Pack 3 - Hotfix for NPR-44637

All

Service Pack 3 - Hotfix for GRANITE-72352

Service Pack 3 - Hotfix for SITES-49893 + SITES-49334 + SITES-48208

Service Pack 3 - Hotfix for GRANITE-71772

Service Pack 3 - Hotfix for GRANITE-75052

Service Pack 3 - Hotfix for GRANITE-71379

Service Pack 3 - Hotfix for NPR-44637

style

grid width 12

Vulnerability Details

CVE-2026-90532

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Notes:

Adobe Experience Manager (AEM) Cloud Service (CS) - Fixed in 2026.9.28386
Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-72352
Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-72352

CVE-2026-105895

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Notes:
Adobe Experience Manager (AEM) Cloud Service (CS) - Not Affected
Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for CQ-4364862
Adobe Experience Manager (AEM) 6.5 LTS - Not Affected

CVE-2026-103848

Vulnerability category: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Notes:

Adobe Experience Manager (AEM) Cloud Service (CS) - Not Affected
Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for NPR-44636
Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for NPR-44637

CVE-2026-75732

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Notes:

CVE-2026-90531

Vulnerability category: Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
Vulnerability impact: Privilege escalation
Severity: Critical
CVSS base score: 9.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Notes:

Adobe Experience Manager (AEM) Cloud Service (CS) - Fixed in 2026.9.28386
Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-71772
Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-71772

CVE-2026-83662

Vulnerability category: Cross-site Scripting (Reflected XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Critical
CVSS base score: 9.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Notes:

Adobe Experience Manager (AEM) Cloud Service (CS) - Fixed in 2026.9.28386
Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for SITES-49894 + SITES-49335 + SITES-48207
Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for SITES-49893 + SITES-49334 + SITES-48208

CVE-2026-106630

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Critical
CVSS base score: 9.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Notes:

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-106629

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-106626

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Notes:

Adobe Experience Manager (AEM) Cloud Service (CS) - Fixed in 2026.9.28386
Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-71379
Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-71379

CVE-2026-106634

Vulnerability category: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Vulnerability impact: Security feature bypass
Severity: Critical
CVSS base score: 7.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Notes:

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-110083

Vulnerability category: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Vulnerability impact: Security feature bypass
Severity: Critical
CVSS base score: 7.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Notes:

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-110084

Vulnerability category: XML Injection (aka Blind XPath Injection) (CWE-91)
Vulnerability impact: Security feature bypass
Severity: Critical
CVSS base score: 7.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Notes:

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-83958

CVE-2026-83960

Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Medium
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Notes:
Adobe Experience Manager (AEM) Cloud Service (CS) - Fixed in 2026.9.28386
Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for SITES-49894 + SITES-49335 + SITES-48207
Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for SITES-49893 + SITES-49334 + SITES-48208
The issue only affects AEM Cloud Service, AEM 6.5 Service Pack 25, and AEM 6.5 LTS Service Pack 3.

CVE-2026-106628

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-110080

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-110079

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-110078

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-110077

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-110076

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-110081

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Medium
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Notes:

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-110075

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-110074

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-107682

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-110073

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-110037

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-109415

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-106631

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-110082

Vulnerability category: Cross-site Scripting (Reflected XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Medium
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Notes:

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-107305

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-106633

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-106632

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-48398

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

CVE-2026-106631

Adobe Experience Manager (AEM) 6.5 - Fixed by Hotfix for GRANITE-75052

Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Hotfix for GRANITE-75052

Acknowledgments

Adobe would like to thank the following researchers for reporting the relevant issues and for working with Adobe to help protect our customers:

Jim Green (green-jam) — CVE-2026-75732, CVE-2026-83958, CVE-2026-83960, CVE-2026-105895, CVE-2026-106628, CVE-2026-110081, CVE-2026-110080, CVE-2026-110079, CVE-2026-110078, CVE-2026-110077, CVE-2026-110076, CVE-2026-110075 CVE-2026-110074, CVE-2026-107682, CVE-2026-107305, CVE-2026-106632,
CVE-2026-48398, CVE-2026-106631
digitalmagician (digitalmagician) — CVE-2026-90531, CVE-2026-106626
Om Ochhane (cod3rjava) — CVE-2026-83662, CVE-2026-106630, CVE-2026-106629
Akshay Sharma (anonymous_blackzero) — CVE-2026-110073, CVE-2026-110037, CVE-2026-109415, CVE-2026-106633

NOTE: Adobe maintains a public bug bounty program through Intigriti. If you’re an external security researcher interested in identifying and responsibly reporting potential security vulnerabilities to Adobe, please visit the Adobe Bug Bounty Program for more information.

For more information, visit Adobe Security Bulletin and Advisories or email PSIRT@adobe.com.

CardTitle

APSB26-152

CardDescription

Priority 2 Security update

CardImage

Created

2026-10-13