EXPOSURES › CVE-2026-75732
CVE-2026-75732
CRITICALAdobe Experience Manager has an unpatched incorrect authorization flaw allowing arbitrary code execution without user interaction.
An incorrect authorization vulnerability in Adobe Experience Manager enables arbitrary code execution in the context of the current user, potentially granting elevated access or control over the victim's account or session without requiring user interaction. DIB organizations must ensure their CMS and content management systems are patched against known CVEs to prevent remote code execution and session hijacking. This failure highlights the risk of relying on unpatched software with critical severity ratings.
Shame score — A critical unpatched vulnerability with CVSS 9.9 that allows arbitrary code execution without user interaction represents a severe, avoidable security failure that could lead to data breaches and system compromise.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.