{"id":"CVE-2026-106626","published":"2026-10-13T20:17:16.270","lastModified":"2026-10-14T15:50:50.180","description":"Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-20"],"vendors":[],"products":[],"references":[{"url":"https://helpx.adobe.com/security/products/experience-manager/apsb26-152.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Adobe Experience Manager contains an improper input validation vulnerability that allows attackers with high privileges to execute arbitrary code as the current user. This represents a critical risk because it enables remote code execution in the application's context.","exploitability":"Exploitation requires high-privilege access but is straightforward once achieved, needing no user interaction and allowing full code execution in the application context.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the AEM server with the privileges of the application user, potentially leading to complete system compromise.","remediation":"Upgrade to Adobe Experience Manager 2.590 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","aem","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:56:57.337Z"}}