Adobe Security Bulletin

Last updated on Nov 10, 2026

Security update available for Adobe Experience Manager | APSB26-189

Bulletin ID

Date published

Priority

APSB26-189

November 10, 2026

style

grid width 12

Summary

Adobe has released a priority 2 security update for Adobe Experience Manager. This update addresses vulnerabilities rated critical and medium that could result in arbitrary code execution, privilege escalation, and security feature bypass.

Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.

Affected Versions

Product

Version

Platform

Adobe Experience Manager (AEM) Cloud Service (CS)

2026.10.29023 and earlier

All

Adobe Experience Manager (AEM) 6.5

Service Pack 25 and earlier

All

Adobe Experience Manager (AEM) 6.5 LTS

Service Pack 3 and earlier

All

style

grid width 12

Solution

Adobe categorizes this update with the following priority rating and recommends users update their installation to the newest version:

Product

Updated version

Platform

Priority rating

Installation instructions

Adobe Experience Manager (AEM) Cloud Service (CS)

2026.10.29251

All

Release Notes

Adobe Experience Manager (AEM) 6.5

Service Pack 23 - Cumulative Hotfix for GRANITE-75052
Service Pack 24 - Cumulative Hotfix for GRANITE-75052
Service Pack 25 - Cumulative Hotfix for GRANITE-75052
Service Pack 25 - Forms Hotfix for AEM 6.5 QuickStart - 1.0.12 (only for instances not running Forms Add-On)
Service Pack 25 - Forms Add-on

All

Service Pack 23 - Cumulative Hotfix for GRANITE-75052: Download
Service Pack 24 - Cumulative Hotfix for GRANITE-75052: Download
Service Pack 25 - Cumulative Hotfix for GRANITE-75052: Download
Service Pack 25 - Forms Hotfix for AEM 6.5 QuickStart - 1.0.12: Download
Service Pack 25 - Forms Add-on: Windows | Linux | OSX

Adobe Experience Manager (AEM) 6.5 LTS

Service Pack 1 - Cumulative Hotfix for GRANITE-75052
Service Pack 2 - Cumulative Hotfix for GRANITE-75052
Service Pack 3 - Cumulative Hotfix for GRANITE-75052

All

Service Pack 1 - Cumulative Hotfix for GRANITE-75052: Download
Service Pack 2 - Cumulative Hotfix for GRANITE-75052: Download
Service Pack 3 - Cumulative Hotfix for GRANITE-75052: Download

style

grid width 12

Vulnerability Details

CVE-2026-114371

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Notes:

Adobe Experience Manager (AEM) Cloud Service (CS) - Fixed in 2026.10.29251
Adobe Experience Manager (AEM) 6.5 - Fixed by Cumulative Hotfix for GRANITE-75052
Adobe Experience Manager (AEM) 6.5 LTS - Fixed by Cumulative Hotfix for GRANITE-75052

CVE-2026-113580

Vulnerability category: Improper Control of Generation of Code ('Code Injection') (CWE-94)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Notes:

CVE-2026-113579

CVE-2026-119017

Adobe Experience Manager (AEM) Cloud Service (CS) - Not Affected
Adobe Experience Manager (AEM) 6.5 - Fixed by Cumulative Hotfix for GRANITE-75052
Adobe Experience Manager (AEM) 6.5 LTS - Not Affected

CVE-2026-114372

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Medium
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Notes:

CVE-2026-118197

Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Medium
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Notes:

CVE-2026-118481

Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Medium
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Notes:

Adobe Experience Manager (AEM) Cloud Service (CS) - Fixed in 2026.10.29251
Adobe Experience Manager (AEM) 6.5 with Forms Add-On - Fixed by AEM Forms 6.5 SP25 Add-on
Adobe Experience Manager (AEM) 6.5 without Forms Add-On - Fixed by Forms Hotfix for AEM 6.5 QuickStart - 1.0.12
Adobe Experience Manager (AEM) 6.5 LTS with Forms Add-On - Fixed by AEM Forms 6.5 SP25 Add-on
Adobe Experience Manager (AEM) 6.5 LTS without Forms Add-On - Not Affected

CVE-2026-118480

CVE-2026-118479

CVE-2026-118482

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Security feature bypass
Severity: Medium
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Notes:

CVE-2026-118478

CVE-2026-123259

CVE-2026-123258

CVE-2026-123341

Vulnerability category: Cross-site Scripting (Reflected XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Medium
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Notes:

Adobe Experience Manager (AEM) Cloud Service (CS) - Fixed in 2026.10.29251
Adobe Experience Manager (AEM) 6.5 - Not Affected
Adobe Experience Manager (AEM) 6.5 LTS - Not Affected

Acknowledgments

Adobe would like to thank the following researchers for reporting the relevant issues and for working with Adobe to help protect our customers:

edra — CVE-2026-114371, CVE-2026-113580, CVE-2026-113579
Jim Green (green-jam) — CVE-2026-114372, CVE-2026-118197, CVE-2026-118481, CVE-2026-118480, CVE-2026-118479, CVE-2026-118478, CVE-2026-119017, CVE-2026-123258
anonymous_blackzero — CVE-2026-123259
digitalmagician — CVE-2026-123341

NOTE: Adobe maintains a public bug bounty program through Intigriti. If you’re an external security researcher interested in identifying and responsibly reporting potential security vulnerabilities to Adobe, please visit the Adobe Bug Bounty Program for more information.

For more information, visit Adobe Security Bulletin and Advisories or email PSIRT@adobe.com.

CardTitle

APSB26-189

CardDescription

Priority 2 Security update

CardImage

Created

2026-11-10

General information

Careers

Trust Center

Corporate responsibility

Legal

Security

Responsible AI

Accessibility

Transparency Center

Compliance

Privacy

Fraud Prevention

Adobe Security Bulletin

Last updated on Nov 10, 2026

Summary

Affected Versions

Solution

Vulnerability Details

Acknowledgments