Loading vulnerability…
Incorrect Authorization Leading to Arbitrary Code Execution in Adobe Experience Manager
CVE-2026-90532 is an incorrect authorization vulnerability in Adobe Experience Manager that permits arbitrary code execution in the context of the current user. Affected releases are identified as versions 2026.0.0 through versions earlier than 2026.9.28386 under advisory APSB26-152. Exploitation requires neither authentication nor user interaction and can cross security boundaries, potentially granting elevated access or control over a victim's account or session. The specific vulnerable function and exploitation mechanism are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise confidentiality, integrity, and availability through arbitrary code execution with the current user's privileges. It may also provide elevated access or control over a victim's account or session. The CVSS assessment assigns high impact to confidentiality, integrity, and availability, with changed scope and a base score of 10.0.
Patch, then assume compromise.
Upgrade Adobe Experience Manager to version 2026.9.28386 or later, as recommended for advisory APSB26-152.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.