CVE-2026-106626 is a critical (CVSS 9.1) improper input validation flaw in Adobe Experience Manager. Adobe says it could allow a high-privileged attacker to execute arbitrary code without user interaction.
What Is It
CVE-2026-106626 is an Improper Input Validation vulnerability (CWE-20) in Adobe Experience Manager (AEM). According to Adobe's description, it "could result in arbitrary code execution in the context of the current user." Adobe's PSIRT reported the issue, and it was published to NVD on October 13, 2026. Its NVD status is "Received," so NVD has not yet completed its own analysis.
Why It Matters
Adobe rates the flaw 9.1 CRITICAL with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H:
- Network-exploitable with low attack complexity
- No user interaction required
- Changed scope, so impact can reach beyond the vulnerable component
- High impact to confidentiality, integrity, and availability
The main limit is that an attacker needs high privileges to exploit it. That lowers the exploitability score to 2.3. Even so, an attacker who compromises an administrative account, or a malicious insider, could potentially use the changed scope to reach other parts of an AEM deployment.
Exploitation status: As of publication, this CVE does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation at this time.
What's Vulnerable
| Product | Affected | Fixed / Unaffected |
|---|---|---|
| AEM as a Cloud Service | Up to and including 2026.9.28187 | 2026.9.28386 |
| AEM 6.5 LTS | Up to and including 6.5 LTS SP3 | SP1, SP2, or SP3 with Hotfix for GRANITE-71379 |
| AEM 6.5 | Up to and including 6.5.25 | 6.5.23, 6.5.24, or 6.5.25 with Hotfix for GRANITE-71379 |
Patch Status
Adobe has published fixes in security bulletin APSB26-152:
- AEM as a Cloud Service: release 2026.9.28386 is listed as unaffected.
- AEM 6.5 LTS: apply the Hotfix for GRANITE-71379 on SP1, SP2, or SP3.
- AEM 6.5: apply the Hotfix for GRANITE-71379 on 6.5.23, 6.5.24, or 6.5.25.
Administrators should check the bulletin for hotfix packages and installation instructions. Because exploitation requires high privileges, it is also sensible to review who holds administrative access to AEM. CISA has not set a required action for this CVE because it has no entry in the KEV catalog.