Adobe has disclosed CVE-2026-90532, an incorrect authorization vulnerability in Adobe Experience Manager. It carries the maximum CVSS 3.1 score of 10.0 and could allow arbitrary code execution.
What Is It
CVE-2026-90532 is an Incorrect Authorization flaw (CWE-863) in Adobe Experience Manager (AEM). The NVD record says successful exploitation could lead to arbitrary code execution in the context of the current user. It could also give the attacker elevated access to, or control over, the victim's account or session. The CVSS vector Adobe assigned shows that exploitation needs no user interaction (UI:N) and that the scope is changed (S:C).
The NVD record was published on 2026-10-13 and is currently in "Received" status.
Why It Matters
Adobe rates this as CRITICAL, with a CVSS 3.1 base score of 10.0:
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Scope: Changed
- Confidentiality / Integrity / Availability: High / High / High
Going by this vector, an attacker could exploit the flaw over the network without credentials or user interaction, and the impact can reach beyond the vulnerable component.
Exploitation status: As of publication, CVE-2026-90532 is not listed in the CISA Known Exploited Vulnerabilities catalog. KEV does not currently confirm active exploitation.
What's Vulnerable
Per Adobe's affected-version data in the NVD record:
| Product | Affected | Unaffected / Fixed |
|---|---|---|
| AEM as a Cloud Service | Versions up to and including 2026.9.28187 | 2026.9.28386 |
| AEM 6.5 LTS | Versions up to and including 6.5 LTS SP3 | 6.5 LTS SP1, SP2, and SP3 with the hotfix for GRANITE-72352 |
| AEM 6.5 | Versions up to and including 6.5.25 | 6.5.20 through 6.5.25 with the hotfix for GRANITE-72352 |
The NVD record lists no CPE entries yet.
Patch Status
Adobe has published fixes in security bulletin APSB26-152:
- AEM as a Cloud Service: Version 2026.9.28386 is listed as unaffected. Make sure your environment is on this release or later.
- AEM 6.5 LTS (SP1–SP3): Apply the hotfix for GRANITE-72352.
- AEM 6.5 (6.5.20–6.5.25): Apply the hotfix for GRANITE-72352.
Because the CVE has no KEV listing, CISA has set no required action or due date. Even so, an unauthenticated, network-reachable flaw scored 10.0 should be patched right away, starting with internet-facing AEM instances. See the Adobe bulletin for hotfix packages and installation steps.
Sources
- Adobe Security Bulletin APSB26-152
- NVD: CVE-2026-90532
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE as of publication)