EXPOSURES › CVE-2026-90532
CVE-2026-90532
CRITICALAdobe Experience Manager has an unpatched incorrect authorization flaw allowing arbitrary code execution without user interaction.
An incorrect authorization vulnerability in Adobe Experience Manager enables arbitrary code execution in the context of the current user, potentially granting elevated access or control over the victim's account or session without requiring user interaction. DIB organizations must ensure their Adobe Experience Manager instances are patched immediately to prevent attackers from exploiting this flaw to compromise systems and exfiltrate sensitive data. Failure to patch known vulnerabilities is a common cause of data breaches and compliance failures under NIST 800-171.
Shame score — A critical CVSS 10.0 vulnerability with arbitrary code execution that requires no user interaction represents a severe, avoidable failure in patch management and authorization controls.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.