{"id":"CVE-2026-113579","published":"2026-11-10T22:18:22.360","lastModified":"2026-11-11T05:19:25.387","description":"Adobe Experience Manager is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Adobe Experience Manager contains a code injection vulnerability (CWE-94) allowing low-privileged attackers to execute arbitrary code in the context of the current user due to improper control of code generation. The vulnerability is exploitable remotely without user interaction and has a changed scope, increasing its severity.","exploitability":"Exploitation requires low privileges and no user interaction, making it highly exploitable by compromised or insider attackers with minimal access.","blast_radius":"Successful exploitation could lead to full system compromise including data theft, unauthorized modifications, and service disruption across the AEM environment.","remediation":"Upgrade to Adobe Experience Manager version 2023.12.0 (6.5.20) or later, as patched in Adobe Security Advisory APSB24-52 published 2024-12-10.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["code-injection","rce","aem","low-privilege","remote-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:45:59.091Z"}}