by Kastro
Paper/Archive/CVE-2026-48359

CVE-2026-48359

Adobe Adobe Experience Manager as a Cloud Service — Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

EPSS 1%CVSS 9.6
critical.is priorityof 100
41
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 63.0.630 × 2012.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to read sensitive files, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

Affected

ProductAffectedFixed inSource
Adobe Experience Manager as a Cloud Service≤ 2026.5.02026.6.0CNA
Adobe Experience Manager 6.5 LTS≤ SP2SP2 - Hotfix for NPR-43972CNA
Adobe Experience Manager 6.5≤ 6.5.256.5.25 - Hotfix for NPR-43971CNA

Scores by source

adobe (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryhelpx.adobe.com/security/products/experience-manager/apsb26-74.html