A low-privileged attacker can exploit an OS command injection flaw (CVSS 9.9) in Adobe Experience Manager 6.5 and 6.5 LTS to run arbitrary code over the network, with no user interaction required.
What Is It
CVE-2026-103848 is an OS command injection vulnerability (CWE-78) in Adobe Experience Manager (AEM). Adobe's PSIRT says the bug lets an attacker execute arbitrary code in the context of the current user. NVD published the record on October 13, 2026. Its status is currently "Received," which means NVD has not yet completed its analysis.
Why It Matters
Adobe scored this flaw 9.9 (Critical) under CVSS 3.1, with the vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That means:
- Network-reachable: it can be exploited remotely, and attack complexity is low.
- Low privileges are enough: an attacker only needs a low-privileged account.
- No user interaction: the attacker does not need anyone to click or open anything.
- Scope changed: the impact can extend beyond the vulnerable component.
- High impact: confidentiality, integrity and availability are all rated high.
AEM is often internet-facing, and an attacker who gains code execution on a content management platform can reach whatever that server can reach. At the time of writing, the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, so there is no KEV confirmation of active exploitation.
What's Vulnerable
According to Adobe's affected-product data:
- Adobe Experience Manager 6.5 LTS: all versions up to and including 6.5 LTS SP3
- Adobe Experience Manager 6.5: all versions up to and including 6.5.25
Patch Status
Adobe has released hotfixes, and Adobe lists these configurations as unaffected:
- AEM 6.5 LTS: SP1, SP2 or SP3 with the Hotfix for NPR-44637
- AEM 6.5: 6.5.20 through 6.5.25 with the Hotfix for NPR-44636
Administrators should apply the right hotfix for their release line, as described in Adobe security bulletin APSB26-152. Because the flaw is critical, network-exploitable and needs only low privileges, AEM instances exposed to the internet or to untrusted users should be patched first. Because no CISA KEV entry exists, there is no federal required action or due date for this CVE.
Sources
- Adobe Security Bulletin APSB26-152
- NVD: CVE-2026-103848
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)