CVE-2026-119017

CriticalCVSS 9.9/10Last modified Nov 12, 2026

Description

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Adobe	Adobe Experience Manager 6.5	<= 6.5.25

References

https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1190257.5open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafte CVE-2026-1190277.5oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted serve CVE-2026-1190288.8oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enu CVE-2026-119035.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc modul CVE-2026-1190325.3The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a CVE-2026-1190332.2The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them chang CVE-2026-1190345.3The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable before returning its CVE-2026-1190356.4The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data output when the Pretty Pri CVE-2026-1190367.5Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signa CVE-2026-1190377.5Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_val CVE-2026-1190386.1Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flo CVE-2026-1190395.3The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout deci