CVE-2026-48289

Analyzed Analyzed - Analysis Complete

Improper Input Validation in Adobe Experience Manager

Publication date: 2026-06-09

Last updated on: 2026-06-10

Assigner: Adobe Systems Incorporated

Description

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-09

Last Modified

2026-06-10

Generated

2026-06-30

AI Q&A

2026-06-09

EPSS Evaluated

2026-06-28

NVD

CVE-2026-48289

EUVD

EUVD-2026-35635

Affected Vendors & Products

Vendor	Product	Version / Range
adobe	experience_manager	6.5
adobe	experience_manager	6.5
adobe	experience_manager	to 6.5.25.0 (exc)
adobe	experience_manager	to 2026.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability affects Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier. It is an Improper Input Validation issue that can lead to a security feature bypass. Specifically, a low-privileged attacker could exploit this vulnerability to bypass security measures and gain unauthorized write access.

Exploitation requires user interaction, meaning the victim must visit a maliciously crafted URL or interact with a compromised web page for the attack to succeed.

Impact Analysis

The vulnerability allows a low-privileged attacker to bypass security features and gain unauthorized write access. This could lead to unauthorized modifications of data or content within Adobe Experience Manager.

Since exploitation requires user interaction, the risk depends on users visiting malicious URLs or interacting with compromised web pages.

Hi! I’m here to help you understand CVE-2026-48289. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70