Adobe rates CVE-2026-119017 as critical (CVSS 9.9). It is an incorrect authorization vulnerability in Adobe Experience Manager 6.5 that, according to Adobe, could allow a low-privileged attacker to execute arbitrary code over the network without user interaction.
What Is It
CVE-2026-119017 is an Incorrect Authorization vulnerability (CWE-863) in Adobe Experience Manager. Adobe PSIRT says a low-privileged attacker could exploit it to execute arbitrary code in the context of the current user. Adobe states that exploitation does not require user interaction and that the scope is changed.
The record was published to NVD on 2026-11-10. Its NVD status is "Received," which means NVD has not yet done its own analysis. The severity details below come from Adobe, not from an independent NVD assessment.
Why It Matters
Adobe scored the flaw 9.9 (CRITICAL) under CVSS 3.1, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That vector means:
- Network-reachable with low attack complexity
- Low privileges required and no user interaction
- Changed scope, so the impact can extend beyond the vulnerable component
- High impact on confidentiality, integrity and availability
If Adobe's assessment holds, the barrier to entry is low: an account with minimal access may be enough to reach code execution. AEM instances with many authenticated users, such as authors, contributors or integration accounts, would therefore face higher risk.
Exploitation status: As of publication, CVE-2026-119017 does not appear in the CISA Known Exploited Vulnerabilities (KEV) Catalog. KEV does not confirm active exploitation at this time.
What's Vulnerable
According to Adobe's affected-product data:
- Product: Adobe Experience Manager 6.5
- Affected: All versions up to and including 6.5.25
- Not affected: 6.5.25 with the Cumulative Hotfix for GRANITE-75398 applied
No CPE entries have been published in the NVD record yet.
Patch Status
Adobe has published security bulletin APSB26-189 for this issue. The affected-version data lists 6.5.25 with the Cumulative Hotfix for GRANITE-75398 as unaffected. AEM 6.5 administrators should:
- Read the full remediation guidance in APSB26-189. Get the bulletin from Adobe's official security bulletins index to make sure you have the authoritative copy.
- Confirm their instances are on 6.5.25 and apply the GRANITE-75398 cumulative hotfix.
- Prioritize instances that are reachable from the internet or that many low-privileged users can access, since Adobe says the attack works over the network with only low privileges.
Because there is no KEV listing, no CISA-mandated due date or required action applies right now. Adobe's critical rating still justifies patching quickly.
Sources
- Adobe Security Bulletin APSB26-189 (Adobe Experience Manager). This link does not use the path Adobe normally uses for security bulletins, so check it against Adobe's Security Bulletins and Advisories index.
- NVD: CVE-2026-119017
- CISA Known Exploited Vulnerabilities Catalog