Adobe has disclosed CVE-2026-75732, a critical (CVSS 9.9) incorrect authorization vulnerability in Adobe Experience Manager 6.5 and 6.5 LTS. Adobe says it could lead to arbitrary code execution without user interaction.
What Is It
CVE-2026-75732 is an Incorrect Authorization vulnerability (CWE-863) in Adobe Experience Manager. Adobe says it "could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session." According to Adobe's CVSS vector, exploitation does not require user interaction, and the scope is changed.
Adobe PSIRT submitted the record to NVD, which published it on 2026-10-13. Its NVD status is "Received," so NVD has not yet run its own analysis.
Why It Matters
Adobe rates the flaw 9.9 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Based on that vector:
- Network-reachable with low attack complexity
- Needs only low privileges and no user interaction
- Changed scope, so the impact could extend beyond the vulnerable component
- High potential impact to confidentiality, integrity and availability
Exploitation status: This CVE is not in the CISA Known Exploited Vulnerabilities (KEV) catalog, and the supplied sources don't confirm active exploitation. Even so, the CVSS vector indicates that an authenticated user with low privileges could exploit it over the network without user interaction. That makes it a high-priority patch for organizations running internet-facing AEM instances.
What's Vulnerable
According to Adobe's affected-product data:
- Adobe Experience Manager 6.5 LTS: versions up to and including 6.5 LTS SP3
- Adobe Experience Manager 6.5: versions up to and including 6.5.25
Patch Status
Adobe lists these hotfixed builds as unaffected:
- AEM 6.5 LTS: SP1, SP2 and SP3 with the hotfix for NPR-44637
- AEM 6.5: 6.5.20 through 6.5.25 with the hotfix for NPR-44636
Required action: Apply the hotfix that matches your AEM release line, as described in Adobe security bulletin APSB26-152. CISA has issued no KEV remediation deadline because the CVE is not in the KEV catalog. If you run AEM 6.5 or 6.5 LTS, check which build you have and confirm the hotfix is installed, starting with internet-exposed instances.