by Kastro
Paper/Archive/CVE-2026-48259

CVE-2026-48259

Adobe Adobe Experience Manager as a Cloud Service — Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)

EPSS 0.9%CVSS 9.6
critical.is priorityof 100
41
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 59.6.596 × 2011.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Adobe Experience Manager is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could leverage this vulnerability to issue unauthorized server-side requests, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

Affected

ProductAffectedFixed inSource
Adobe Experience Manager as a Cloud Service≤ 2026.5.02026.6.0CNA
Adobe Experience Manager 6.5 LTS≤ SP2SP2 - Hotfix for NPR-43972CNA
Adobe Experience Manager 6.5≤ 6.5.256.5.25 - Hotfix for NPR-43971CNA

Scores by source

adobe (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryhelpx.adobe.com/security/products/experience-manager/apsb26-74.html