Adobe has disclosed CVE-2026-48383, an incorrect authorization flaw in Adobe Experience Manager. It has the maximum CVSS 3.1 score of 10.0 and can lead to arbitrary code execution without user interaction.
What Is It
CVE-2026-48383 is an Incorrect Authorization vulnerability (CWE-863) in Adobe Experience Manager (AEM). Adobe's description says successful exploitation "could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session." Adobe also says exploitation does not require user interaction and that the scope is changed.
Adobe PSIRT published the record to NVD on October 13, 2026. Its NVD status is "Received," which means NVD has not finished its own analysis yet.
Why It Matters
Adobe gave the flaw the highest possible CVSS 3.1 score of 10.0 (CRITICAL), with this vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Scope: Changed
- Confidentiality, integrity and availability impact: High
This means the flaw can be exploited remotely, without authentication or user interaction, and can affect resources beyond the vulnerable component.
Exploitation status: At the time of writing, CVE-2026-48383 does not appear in the CISA Known Exploited Vulnerabilities (KEV) Catalog. The supplied data does not confirm active exploitation.
What's Vulnerable
Adobe lists these affected products and versions:
| Product | Affected | Fixed / Unaffected |
|---|---|---|
| AEM as a Cloud Service | Versions through 2026.9.28187 | 2026.9.28386 |
| AEM 6.5 LTS | Versions through 6.5 LTS SP3 | SP1, SP2 and SP3 with the hotfix for GRANITE-72352 |
| AEM 6.5 | Versions through 6.5.25 | 6.5.20 through 6.5.25 with the hotfix for GRANITE-72352 |
Patch Status
Adobe has released fixes, documented in security bulletin APSB26-152:
- AEM as a Cloud Service: Make sure environments run release 2026.9.28386 or later.
- AEM 6.5 LTS: Apply the GRANITE-72352 hotfix to SP1, SP2 or SP3.
- AEM 6.5: Apply the GRANITE-72352 hotfix to versions 6.5.20 through 6.5.25.
The flaw has the maximum severity score and requires neither authentication nor user interaction, so administrators should patch it as a priority. See the Adobe bulletin for full remediation guidance.