CVE-2026-105895 is a critical (CVSS 9.9) improper input validation flaw in Adobe Experience Manager 6.5 that could let a low-privileged attacker execute arbitrary code over the network without user interaction.
What Is It
CVE-2026-105895 is an Improper Input Validation vulnerability (CWE-20) in Adobe Experience Manager (AEM). Adobe's PSIRT reported it, and NVD published it on October 13, 2026. NVD currently lists its status as "Received."
The description says successful exploitation could result in arbitrary code execution in the context of the current user. That could give the attacker elevated access to, or control over, the victim's account or session. Adobe notes that exploitation does not require user interaction and that the scope is changed.
Why It Matters
Adobe scored the flaw 9.9 (CRITICAL) under CVSS 3.1, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That vector means:
- Attack vector: Network. It can be exploited remotely.
- Attack complexity: Low. No special conditions are needed.
- Privileges required: Low. The attacker needs some level of authenticated access.
- User interaction: None. No victim action is needed.
- Scope: Changed. The impact can reach beyond the vulnerable component.
- Confidentiality, integrity and availability: High impact on all three.
Low attack complexity, no user interaction and a changed scope together make this a high-priority issue for organizations running AEM 6.5.
Exploitation status: As of publication, CVE-2026-105895 does not appear in the CISA Known Exploited Vulnerabilities (KEV) Catalog. KEV does not currently confirm active exploitation.
What's Vulnerable
According to Adobe's affected-product data in the NVD record:
- Affected: Adobe Experience Manager 6.5, versions up to and including 6.5.25
- Unaffected:
- 6.5.23 with Hotfix for CQ-4364862
- 6.5.24 with Hotfix for CQ-4364862
- 6.5.25 with Hotfix for CQ-4364862
The NVD record lists no CPE entries yet.
Patch Status
Adobe's affected-version data lists 6.5.23, 6.5.24 and 6.5.25 as unaffected once the Hotfix for CQ-4364862 is applied. Administrators running AEM 6.5 should check their version and apply that hotfix. For full remediation guidance, see Adobe Security Bulletin APSB26-152.
Because the CVE is not listed in the CISA KEV Catalog, CISA has set no required action or due date for it at this time.