Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
Critical 9.9
CVE-2026-105895
Adobe Experience Manager — remote code execution.
Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over…
Published Updated Source NVD
CVSS 3.1
9.9
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Exploit chance, 30 days
0.7%
Higher than 53% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory
What happened
What to do
- 01Check whether you run Adobe Experience Manager, and which version.
- 02Follow the vendor advisory for a fix or a workaround.
References
Timeline · UTC
- Published to NVD
- NVD record updated
Also actively exploited
Other CVEs in Adobe Experience Manager
5 more CVEs
9.6Adobe Experience Manager — privilege escalation.EPSS 1.4%10.0Adobe Experience Manager — remote code execution.EPSS 0.8%9.1Adobe Experience Manager — remote code execution.EPSS 0.7%9.3Adobe Experience Manager — cross-site scripting.EPSS 0.9%9.3Adobe Experience Manager — cross-site scripting.EPSS 0.9%