EXPOSURES › CVE-2026-48383
CVE-2026-48383
CRITICALAdobe Experience Manager has an unpatched incorrect authorization flaw allowing arbitrary code execution without user interaction.
An incorrect authorization vulnerability in Adobe Experience Manager enables arbitrary code execution in the context of the current user, potentially granting elevated access or control over the victim's account or session. Exploitation requires no user interaction, making it highly dangerous for DIB organizations relying on this software for content management and digital experiences. Organizations must patch immediately as no workarounds are available, and this failure highlights the risk of unpatched critical CVEs in the supply chain.
Shame score — A critical CVSS 10.0 vulnerability with no user interaction required and no available workarounds represents a severe, avoidable exposure that could lead to data breaches or ransomware entry if exploited in the wild.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.