{"id":"CVE-2026-90531","published":"2026-10-13T20:19:10.030","lastModified":"2026-10-14T15:50:50.180","description":"Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-611"],"vendors":[],"products":[],"references":[{"url":"https://helpx.adobe.com/security/products/experience-manager/apsb26-152.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Adobe Experience Manager contains an XXE vulnerability that allows low-privileged attackers to escalate privileges and access internal resources. This critical flaw enables remote code execution without user interaction.","exploitability":"Exploitation is straightforward requiring only a single HTTP request with crafted XML data, with no user interaction needed.","blast_radius":"If exploited, this vulnerability could allow attackers to gain elevated access to internal systems and sensitive data across the entire Adobe Experience Manager platform.","remediation":"Apply the latest available security patch from Adobe for Adobe Experience Manager 2.590 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xxe","privilege-escalation","web"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:53:50.299Z"}}