CVE-2026-114371 is a critical (CVSS 9.9) incorrect authorization flaw in Adobe Experience Manager that could let a low-privileged attacker execute arbitrary code over the network without any user interaction.
What Is It
CVE-2026-114371 is an Incorrect Authorization weakness (CWE-863) in Adobe Experience Manager (AEM). According to Adobe's description in the NVD record, a low-privileged attacker could exploit the flaw to execute arbitrary code in the context of the current user. Exploitation does not require user interaction, and the scope is changed.
Adobe PSIRT reported the CVE and published it on November 10, 2026. NVD lists its status as "Received," which means NVD has not yet completed its own analysis.
Why It Matters
Adobe assigned the flaw a CVSS 3.1 base score of 9.9 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In practical terms:
- Network-reachable: an attacker can exploit it remotely.
- Low complexity: no special conditions are needed.
- Low privileges: an authenticated low-privileged account may be enough.
- No user interaction: no one has to click anything.
- Scope changed: the impact can reach beyond the vulnerable component.
- High impact on confidentiality, integrity, and availability.
AEM is a content management platform that often faces the internet. That makes a low-privilege path to code execution a high-priority issue.
Exploitation status: The supplied CISA KEV data has no entry for this CVE, so KEV does not currently confirm active exploitation. This could change. Check the KEV catalog again if you can't patch right away.
What's Vulnerable
According to Adobe's affected-version data:
| Product | Affected | Fixed / Unaffected |
|---|---|---|
| AEM as a Cloud Service | Versions up to and including 2026.10.29023 | 2026.10.29251 |
| AEM 6.5 | Versions up to and including 6.5.25 | 6.5.25 with Cumulative Hotfix for GRANITE-75398 |
| AEM 6.5 LTS | Versions up to and including 6.5 LTS SP3 | 6.5 LTS SP3 with Cumulative Hotfix for GRANITE-75398 |
Patch Status
Adobe has released fixes, documented in security bulletin APSB26-189:
- AEM as a Cloud Service: Make sure your environment is on release 2026.10.29251 or later.
- AEM 6.5: Apply the Cumulative Hotfix for GRANITE-75398 on top of 6.5.25.
- AEM 6.5 LTS: Apply the Cumulative Hotfix for GRANITE-75398 on top of 6.5 LTS SP3.
The supplied data contains no CISA-required action or due date, because there is no KEV listing. Given the critical score and low-privilege attack path, prioritize the patch anyway. Also review which accounts have low-privileged access to AEM instances.
Sources
- Adobe Security Bulletin APSB26-189
- NVD: CVE-2026-114371
- CISA Known Exploited Vulnerabilities Catalog (no entry found for this CVE in the supplied data)