Loading vulnerability…
Adobe Experience Manager Path Traversal Arbitrary File Read
CVE-2026-48310 is a path traversal vulnerability in Adobe Experience Manager caused by improper limitation of a pathname to a restricted directory. Crafted path input can cause the affected application to access files and directories outside its intended access scope, resulting in arbitrary file-system read. Affected releases include Adobe Experience Manager as a Cloud Service through 2026.5.0, Adobe Experience Manager 6.5 LTS through SP1, and Adobe Experience Manager 6.5 through 6.5.24.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated remote attacker can read sensitive files and directories outside the intended application-access scope. The vulnerability is rated CVSS v3.1 8.6 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N; confidentiality impact is high, while integrity and availability impact are not identified.
If you can’t patch tonight, do this now.
Until the applicable vendor update is deployed, restrict network access to AEM authoring and administrative interfaces to trusted users and networks, enforce least privilege, and monitor application requests and logs for path-traversal attempts and anomalous file-access activity.
Patch, then assume compromise.
Update Adobe Experience Manager as a Cloud Service to release 2026.6.0. For Adobe Experience Manager 6.5 LTS, upgrade to Service Pack 2 and apply the hotfix for NPR-43972. For Adobe Experience Manager 6.5, upgrade to version 6.5.25 and apply the hotfix for NPR-43972.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.