{"id":"CVE-2026-114371","published":"2026-11-10T22:18:22.617","lastModified":"2026-11-11T05:19:25.677","description":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Adobe Experience Manager contains an Incorrect Authorization (CWE-863) vulnerability allowing low-privileged users to bypass intended access controls and execute arbitrary code in their own context. The flaw enables privilege escalation without user interaction due to improper scope enforcement during authorization checks.","exploitability":"Exploitation requires only low-privileged access and no user interaction, making it highly exploitable for compromised or insider accounts with minimal permissions.","blast_radius":"Successful exploitation could lead to full compromise of the AEM instance—including data theft, code injection, and lateral movement—since the attacker gains arbitrary code execution within the application's runtime context.","remediation":"Upgrade to Adobe Experience Manager 6.5.17.0 or later, as patched in Adobe Security Advisory APSB26-14 (published 2026-03-18).","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","privilege-escalation","rce","aem","webapp"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:46:22.224Z"}}