CVE-2026-19232

Analyzed Analyzed - Analysis Complete

Incorrect Authorization in Adobe Experience Manager Leading to Arbitrary Code Execution

Publication date: 2026-09-08

Last updated on: 2026-09-11

Assigner: Adobe Systems Incorporated

Description

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. A low-privileged attacker could exploit this vulnerability to gain elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-11

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-19232

Affected Vendors & Products

Vendor	Product	Version / Range
adobe	experience_manager	6.5
adobe	experience_manager	6.5
adobe	experience_manager	to 6.5.25.0 (exc)
adobe	experience_manager	6.5
adobe	experience_manager	to 2026.8.0 (exc)
adobe	experience_manager	to 6.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Adobe Experience Manager has an Incorrect Authorization vulnerability that allows low-privileged attackers to execute arbitrary code with elevated access. This can lead to full control over the victim's account or session without requiring user interaction.

Impact Analysis

An attacker could gain elevated access to your account or session, potentially allowing them to execute malicious code, steal sensitive data, or take control of your system. Since exploitation doesn't require user interaction, you could be affected even without clicking a link.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Apply the latest security patches from Adobe for Adobe Experience Manager immediately. Review and restrict user permissions to the minimum required. Monitor for unusual activity or unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-19232. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70