Key points
- National Vulnerability Database rates CVE-2026-90532 as Critical with a CVSS score of 10.0.
- The vulnerability allows arbitrary code execution in the context of the current user.
- Affected versions include Adobe Experience Manager as a Cloud Service up to 2026.9.28187.
Adobe Experience Manager contains a critical authorization flaw that permits arbitrary code execution. According to the National Vulnerability Database, this issue, tracked as CVE-2026-90532, allows attackers to run code in the context of the current user. The vulnerability is classified as Incorrect Authorization under CWE-863. Exploitation does not require any user interaction, making remote attacks possible. Attackers could potentially gain elevated access or take control of victim accounts or sessions. The scope of the vulnerability is noted as changed in the advisory records.
By the numbers
- CVSS 10.0 is the severity rating assigned by the National Vulnerability Database for CVE-2026-90532.
- CWE-863 is the weakness identifier for the Incorrect Authorization vulnerability affecting Adobe Experience Manager.
- 2026.9.28187 is the latest affected version of Adobe Experience Manager as a Cloud Service.
What the figures mean
A CVSS score of 10.0 indicates maximum severity for this vulnerability. The National Vulnerability Database describes the issue as allowing arbitrary code execution. This means an attacker can run commands on the affected system. The lack of required user interaction simplifies exploitation significantly. Attackers can target the system remotely without needing to trick a user into clicking a link. The potential for gaining elevated access or session control increases the risk to organizations using Adobe Experience Manager. The scope change noted in the record suggests the vulnerability impacts more than just the local context.
What to watch
Organizations using Adobe Experience Manager should monitor for unauthorized code execution attempts. The vulnerability affects multiple versions, including Adobe Experience Manager 6.5 LTS up to SP3. Adobe Experience Manager 6.5 up to 6.5.25 is also listed as affected. Adobe Experience Manager as a Cloud Service up to version 2026.9.28187 is vulnerable. Security teams should check their current versions against this list. Any system running these versions is potentially exposed to remote exploitation. Monitoring logs for unusual activity or new processes can help detect exploitation attempts.
Infection and persistence in general
Teams usually investigate how this category of malware arrives and persists. Analysts examine initial access vectors and lateral movement techniques. They check for unauthorized scripts or binaries executed in user contexts. Persistence mechanisms often involve scheduled tasks or registry modifications. Spread typically occurs through network shares or credential theft. Analysts look for signs of elevated privileges being abused. They review session tokens and account permissions for anomalies. General behavior includes establishing backdoors and exfiltrating data. Teams assess whether the malware communicates with command and control servers.
What to do and how to stay safe: Adobe Experience Manager
- Verify your Adobe Experience Manager version against the affected list provided by the National Vulnerability Database.
- Monitor system logs for unexpected code execution or unauthorized access attempts in user contexts.
- Restrict network access to Adobe Experience Manager instances to reduce exposure to remote attacks.
- Once the vendor provides an update, apply patches immediately to mitigate the authorization flaw.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Adobe Experience Manager are affected by CVE-2026-90532?
Affected versions include Adobe Experience Manager as a Cloud Service up to 2026.9.28187, Adobe Experience Manager 6.5 LTS up to 6.5 LTS SP3, and Adobe Experience Manager 6.5 up to 6.5.25.
Does exploiting CVE-2026-90532 require user interaction?
No, the National Vulnerability Database states that exploitation of this issue does not require user interaction.
What is the severity rating for CVE-2026-90532?
The National Vulnerability Database rates CVE-2026-90532 as Critical with a CVSS score of 10.0.
