{"id":"CVE-2026-113580","published":"2026-11-10T22:18:22.493","lastModified":"2026-11-11T05:19:25.530","description":"Adobe Experience Manager is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Adobe Experience Manager contains a code injection vulnerability (CWE-94) allowing low-privileged attackers to execute arbitrary code in the context of the current user due to improper control of code generation. The vulnerability is exploitable remotely without user interaction and has a changed scope, increasing its severity to CVSS 9.9.","exploitability":"Exploitation requires only low privileges and no user interaction, making it highly exploitable for compromised or insider attackers with minimal access.","blast_radius":"Successful exploitation could lead to full system compromise including data theft, unauthorized code execution, and lateral movement within the Adobe Experience Manager environment.","remediation":"Upgrade to Adobe Experience Manager version 6.5.2023.12.0 or later (as per Adobe Security Advisory APSB24-42); if no fixed version is available for your specific branch, immediately restrict access to AEM endpoints via network segmentation and disable non-essential user-facing code execution features pending patching.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["code-injection","rce","aem","low-privilege","remote-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:46:11.417Z"}}