Adobe Experience Manager has a critical code injection flaw (CVE-2026-113580). A low-privileged attacker can use it to run arbitrary code over the network, and no user interaction is needed.
What Is It
CVE-2026-113580 is an Improper Control of Generation of Code ("Code Injection") flaw, tracked as CWE-94, in Adobe Experience Manager (AEM). Adobe says a successful attack could lead to arbitrary code execution in the context of the current user. The attacker needs only low privileges, and no user interaction is required.
Adobe PSIRT reported the issue, and the CVE was published on 2026-11-10. The NVD record status is "Received," which means NVD has not yet run its own analysis.
Why It Matters
Adobe scores this flaw 9.9 (CRITICAL) under CVSS 3.1, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In practice:
- Network-reachable and low attack complexity
- Low privileges and no user interaction needed
- Scope changed: the impact can reach beyond the vulnerable component
- High impact on confidentiality, integrity and availability
AEM is often a public-facing content platform. Any authenticated low-privileged account could become a starting point for running code.
Exploitation status: CVE-2026-113580 does not appear in the supplied CISA KEV data. The supplied sources do not confirm active exploitation.
What's Vulnerable
According to Adobe's affected-version data:
| Product | Affected | Unaffected / Fixed |
|---|---|---|
| AEM as a Cloud Service | Versions up to and including 2026.10.29023 | 2026.10.29251 |
| AEM 6.5 | Versions up to and including 6.5.25 | 6.5.25 – Cumulative Hotfix for GRANITE-75398 |
| AEM 6.5 LTS | Versions up to and including 6.5 LTS SP3 | 6.5 LTS SP3 – Cumulative Hotfix for GRANITE-75398 |
Patch Status
Adobe has released fixes, listed in security bulletin APSB26-189:
- AEM as a Cloud Service: move to release 2026.10.29251.
- AEM 6.5: apply the 6.5.25 Cumulative Hotfix for GRANITE-75398.
- AEM 6.5 LTS: apply the 6.5 LTS SP3 Cumulative Hotfix for GRANITE-75398.
There is no CISA KEV required-action entry for this CVE in the supplied data. The score is critical and only low privileges are needed, so defenders should check Adobe's bulletin and patch exposed AEM instances quickly.