Adobe has disclosed CVE-2026-48382, an incorrect authorization flaw in Adobe Experience Manager with a CVSS score of 10.0. Adobe says the flaw could lead to arbitrary code execution without user interaction.
What Is It
CVE-2026-48382 is an Incorrect Authorization vulnerability (CWE-863) in Adobe Experience Manager (AEM). Adobe's description says it "could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session." Exploitation does not require user interaction, and the scope is changed.
Adobe PSIRT reported the flaw, and NVD published it on 2026-10-13. Its NVD status is "Received," which means NVD has not finished its own analysis yet.
Why It Matters
Adobe scored the flaw 10.0 (CRITICAL), the highest possible CVSS 3.1 score. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H:
- Network-reachable with low attack complexity
- No privileges and no user interaction required
- Scope changed, so the impact can reach beyond the vulnerable component
- High impact to confidentiality, integrity and availability
As of this writing, CVE-2026-48382 is not in the CISA Known Exploited Vulnerabilities catalog, so KEV does not confirm active exploitation. Defenders should still patch quickly, because the flaw can be reached over the network, needs no authentication and has the top score.
What's Vulnerable
Adobe lists three affected product lines:
| Product | Affected | Unaffected / Fixed |
|---|---|---|
| AEM as a Cloud Service | Versions up to and including 2026.9.28187 | 2026.9.28386 |
| AEM 6.5 LTS | Versions up to and including 6.5 LTS SP3 | SP1, SP2 and SP3 with the hotfix for GRANITE-72352 |
| AEM 6.5 | Versions up to and including 6.5.25 | 6.5.20 through 6.5.25 with the hotfix for GRANITE-72352 |
Patch Status
Adobe has released fixes through security bulletin APSB26-152:
- AEM as a Cloud Service: Make sure the environment is on release 2026.9.28386 or later.
- AEM 6.5 LTS: Apply the hotfix for GRANITE-72352 on SP1, SP2 or SP3.
- AEM 6.5: Apply the hotfix for GRANITE-72352 on 6.5.20 through 6.5.25.
The CVE is not currently listed in the CISA KEV catalog, so no federal remediation deadline applies right now. Given the critical score and the unauthenticated network attack vector, organizations running self-managed AEM 6.5 or 6.5 LTS should apply the GRANITE-72352 hotfix first.