Adobe Security Bulletin

Last updated on Sep 16, 2026

Security updates available for Adobe Experience Manager | APSB26-98

Bulletin ID

Date published

Priority

APSB26-98

September 8, 2026

style

grid width 12

Summary

Adobe has released a security update for Adobe Experience Manager (AEM). This update addresses important and moderate vulnerabilities that could result in privilege escalation, security feature bypass, and arbitrary code execution.

Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.

Affected product versions

Product

Version

Platform

Adobe Experience Manager (AEM)

AEM Cloud Service (CS) Release 2026.7.0 and earlier

All

Adobe Experience Manager (AEM)

6.5 LTS Service Pack 2 and earlier

All

Adobe Experience Manager (AEM)

6.5 Service Pack 24 and earlier

All

style

grid width 12

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:

Product

Version

Platform

Priority

Availability

Adobe Experience Manager (AEM)

AEM Cloud Service (CS) Release 2026.8.0

All

Release Notes

Adobe Experience Manager (AEM)

6.5 LTS Service Pack 3

All

Release Notes

Adobe Experience Manager (AEM)

6.5 Service Pack 25

All

Release Notes

style

grid width 12

Vulnerability Details

CVE-2026-19232

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2025-64830

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVE-2026-75735

CVE-2026-84397

CVE-2026-75736

CVE-2026-75737

CVE-2026-75738

CVE-2026-71440

CVE-2026-27227

CVE-2026-75739

CVE-2025-64618

CVE-2025-64610

CVE-2026-75740

CVE-2026-75741

CVE-2025-64589

CVE-2025-64588

CVE-2026-75742

CVE-2025-64584

CVE-2026-27222

Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVE-2026-71357

Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

TBD

Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

TBD

CVE-2025-64542

CVE-2026-75719

CVE-2026-75720

CVE-2026-75722

CVE-2026-75724

CVE-2026-75725

CVE-2026-71356

CVE-2026-75727

CVE-2026-79905

CVE-2026-27258

CVE-2025-64868

CVE-2025-64866

CVE-2026-75729

CVE-2025-64854

CVE-2026-71388

CVE-2026-75730

CVE-2026-75731

CVE-2025-64838

CVE-2026-75733

CVE-2026-75734

CVE-2026-75695

CVE-2026-75696

CVE-2026-75700

CVE-2026-75701

CVE-2026-75702

CVE-2026-75704

CVE-2026-75705

CVE-2026-75706

CVE-2026-75707

CVE-2026-75708

CVE-2026-75709

CVE-2026-75710

CVE-2026-75711

CVE-2026-75712

CVE-2026-75713

CVE-2026-75714

CVE-2026-75715

CVE-2026-75716

CVE-2026-75717

CVE-2026-75718

CVE-2026-75668

CVE-2026-75669

CVE-2026-75670

CVE-2026-75671

CVE-2026-75672

CVE-2026-75674

CVE-2026-75675

CVE-2026-75677

CVE-2026-75678

CVE-2026-75679

CVE-2026-75680

CVE-2026-75681

CVE-2026-75683

CVE-2026-75685

CVE-2026-75687

CVE-2026-75690

CVE-2026-75691

CVE-2026-75692

CVE-2026-75693

CVE-2026-75694

CVE-2026-19713

CVE-2026-75629

CVE-2026-75635

CVE-2026-75636

CVE-2026-75637

CVE-2026-75639

CVE-2026-75640

CVE-2026-75642

CVE-2026-75643

CVE-2026-75644

CVE-2026-75646

CVE-2026-75647

CVE-2026-75651

CVE-2026-75652

CVE-2026-75657

CVE-2026-75659

CVE-2026-75660

CVE-2026-75661

CVE-2026-75666

CVE-2026-75667

CVE-2026-19644

CVE-2026-19612

CVE-2026-19479

CVE-2026-72627

CVE-2026-72626

CVE-2026-71565

CVE-2026-75726

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Security feature bypass
Severity: Moderate
CVSS base score: 3.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Note

AEM 6.5 Service Pack and LTS versions are not impacted by the following CVEs: CVE-2026-19232

Note

Effective August 11, 2026, Adobe may assign a single CVE identifier to internally discovered vulnerabilities with the same severity rating and CWE category when a release includes systemic fixes.

style

xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Updates to Dependencies

CVE

Dependency

Updated Version

Notes

CVE-2026-18401

Jackson-databind

2.21.3

Delivered in Service Pack 25

CVE-2025-66516

Apache Tika

1.28.6-B0002

Delivered in LTS Service Pack 3

Acknowledgments

Adobe would like to thank the following for reporting these issues and for working with Adobe to help protect our customers:

Om Ochhane (cod3rjava) — CVE-2026-19232
Jim Green (green-jam) — CVE-2025-64830, CVE-2026-75735, CVE-2026-27238, CVE-2026-75736, CVE-2026-75737, CVE-2026-75738, CVE-2026-71440, CVE-2026-27227, CVE-2026-75739, CVE-2025-64618, CVE-2025-64610, CVE-2026-75741, CVE-2025-64589, CVE-2025-64588, CVE-2026-75742, CVE-2025-64584, CVE-2026-27222, CVE-2026-71357, CVE-2025-64542, CVE-2026-75719, CVE-2026-75720, CVE-2026-75722, CVE-2026-75724, CVE-2026-75725, CVE-2026-71356, CVE-2025-64868, CVE-2025-64866, CVE-2026-75729, CVE-2025-64854, CVE-2026-71388, CVE-2026-75730, CVE-2026-75731, CVE-2025-64838, CVE-2026-75733, CVE-2026-75734, CVE-2026-75695, CVE-2026-75696, CVE-2026-75700, CVE-2026-75701, CVE-2026-75702, CVE-2026-75704, CVE-2026-75705, CVE-2026-75706, CVE-2026-75707, CVE-2026-75708, CVE-2026-75709, CVE-2026-75710, CVE-2026-75711, CVE-2026-75712, CVE-2026-75713, CVE-2026-75714, CVE-2026-75715, CVE-2026-75716, CVE-2026-75717, CVE-2026-75718, CVE-2026-75668, CVE-2026-75669, CVE-2026-75670, CVE-2026-75671, CVE-2026-75672, CVE-2026-75674, CVE-2026-75675, CVE-2026-75677, CVE-2026-75678, CVE-2026-75679, CVE-2026-75680, CVE-2026-75681, CVE-2026-75683, CVE-2026-75685, CVE-2026-75687, CVE-2026-75690, CVE-2026-75691, CVE-2026-75692, CVE-2026-75693, CVE-2026-75694, CVE-2026-19713, CVE-2026-75629, CVE-2026-75635, CVE-2026-75636, CVE-2026-75637, CVE-2026-75639, CVE-2026-75640, CVE-2026-75646, CVE-2026-75647, CVE-2026-75651, CVE-2026-75652, CVE-2026-75657, CVE-2026-75659, CVE-2026-75660, CVE-2026-75661, CVE-2026-75666, CVE-2026-75667, CVE-2026-19644, CVE-2026-19612, CVE-2026-19479, CVE-2026-72627, CVE-2026-72626, CVE-2026-71565
anonymous_blackzero — CVE-2026-75727, CVE-2026-79905, CVE-2026-27258, CVE-2026-75642, CVE-2026-75643, CVE-2026-75644, CVE-2026-75726

Revisions

September 16, 2026: Replaced CVE-2026-27238 with correct CVE: CVE-2026-84397.
For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com.

NOTE: Adobe has a public bug bounty program with Intigriti. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail.

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com.

CardTitle

APSB26-98

CardDescription

Priority 2 Security update

CardImage

Created

2026-09-08

Tags

caas:content-type/documentation,caas:trust-center/security-bulletin,caas:products/adobe-experience-manager

PrimaryTag

caas:content-type/article

Details

caas:mnemonics/adobe-experience-manager

Arbitrary

search: CVE-2026-19232 CVE-2025-64830 CVE-2026-75735 CVE-2026-84397 CVE-2026-75736 CVE-2026-75737 CVE-2026-75738 CVE-2026-71440 CVE-2026-27227 CVE-2026-75739 CVE-2025-64618 CVE-2025-64610 CVE-2026-75740 CVE-2026-75741 CVE-2025-64589 CVE-2025-64588 CVE-2026-75742 CVE-2025-64584 CVE-2026-27222 CVE-2026-71357 CVE-2025-64542 CVE-2026-75719 CVE-2026-75720 CVE-2026-75722 CVE-2026-75724 CVE-2026-75725 CVE-2026-71356 CVE-2026-75727 CVE-2026-79905 CVE-2026-27258 CVE-2025-64868 CVE-2025-64866 CVE-2026-75729 CVE-2025-64854 CVE-2026-71388 CVE-2026-75730 CVE-2026-75731 CVE-2025-64838 CVE-2026-75733 CVE-2026-75734 CVE-2026-75695 CVE-2026-75696 CVE-2026-75700 CVE-2026-75701 CVE-2026-75702 CVE-2026-75704 CVE-2026-75705 CVE-2026-75706 CVE-2026-75707 CVE-2026-75708 CVE-2026-75709 CVE-2026-75710 CVE-2026-75711 CVE-2026-75712 CVE-2026-75713 CVE-2026-75714 CVE-2026-75715 CVE-2026-75716 CVE-2026-75717 CVE-2026-75718 CVE-2026-75668 CVE-2026-75669 CVE-2026-75670 CVE-2026-75671 CVE-2026-75672 CVE-2026-75674 CVE-2026-75675 CVE-2026-75677 CVE-2026-75678 CVE-2026-75679 CVE-2026-75680 CVE-2026-75681 CVE-2026-75683 CVE-2026-75685 CVE-2026-75687 CVE-2026-75690 CVE-2026-75691 CVE-2026-75692 CVE-2026-75693 CVE-2026-75694 CVE-2026-19713 CVE-2026-75629 CVE-2026-75635 CVE-2026-75636 CVE-2026-75637 CVE-2026-75639 CVE-2026-75640 CVE-2026-75642 CVE-2026-75643 CVE-2026-75644 CVE-2026-75646 CVE-2026-75647 CVE-2026-75651 CVE-2026-75652 CVE-2026-75657 CVE-2026-75659 CVE-2026-75660 CVE-2026-75661 CVE-2026-75666 CVE-2026-75667 CVE-2026-19644 CVE-2026-19612 CVE-2026-19479 CVE-2026-72627 CVE-2026-72626 CVE-2026-71565 CVE-2026-75726 CVE-2026-27238