{"id":"CVE-2026-113579","kind":"vulnerability","aliases":["CVE-2026-113579"],"related":[],"title":"Adobe Experience Manager: code injection lets a low-privileged user run code (APSB26-189)","description":"Adobe Experience Manager is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","summary":"Adobe Experience Manager has a code injection flaw (CWE-94, CVSS 9.9) that allows arbitrary code execution for an authenticated low-privileged user over the network, with no user interaction. Adobe fixed it in bulletin APSB26-189 on November 10, 2026 and says it knows of no exploitation in the wild.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Experience Manager Cloud Service","fixed":["2026.10.29251"],"affected":"<= 2026.10.29023","ecosystem":"vendor"},{"name":"Adobe Experience Manager 6.5","fixed":["Cumulative Hotfix for GRANITE-75052"],"affected":"<= SP25","ecosystem":"vendor"},{"name":"Adobe Experience Manager 6.5 LTS","fixed":["Cumulative Hotfix for GRANITE-75052"],"affected":"<= SP3","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-experience-manager","aem","authenticated","cloud-service","self-hosted","vendor"],"not_affected_if":["no-aem"],"how_to_check":"Self-hosted 6.5 or 6.5 LTS: check whether the Cumulative Hotfix for GRANITE-75052 is installed on your Service Pack (6.5 SP23-SP25, 6.5 LTS SP1-SP3) via the Package Manager / installed packages. AEM as a Cloud Service: check the running release; versions 2026.10.29023 and earlier are affected.","fix":"AEM Cloud Service: update to release 2026.10.29251. AEM 6.5 (SP23, SP24, SP25) and AEM 6.5 LTS (SP1, SP2, SP3): install the matching Cumulative Hotfix for GRANITE-75052 from the bulletin.","status":"open","published_at":"2026-11-10T22:18:22+00:00","first_seen_at":"2026-11-10T22:27:25+00:00","triaged_at":"2026-11-10T22:28:40+00:00","updated_at":"2026-11-10T22:37:03+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-10T22:28:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Adobe Experience Manager: code injection lets a low-privileged user run code","impact":"high","summary":"Adobe Experience Manager has a code injection flaw that lets an attacker run arbitrary code as the current user. A low-privileged account is enough, and no user interaction is needed.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["adobe-experience-manager","aem"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary code on the AEM server","analyst_note":"Find affected AEM versions, fixed releases and the Adobe security bulletin for CVE-2026-113579; the NVD entry lacks product ranges.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organisations running Adobe Experience Manager. The sources do not name affected versions or configurations, so exposure cannot be confirmed from them. Teams that do not run Adobe Experience Manager can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00067,"input_tokens":4570,"output_tokens":425,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find affected AEM versions, fixed releases and the Adobe security bulletin for CVE-2026-113579; the NVD entry lacks product ranges.","search":"'-113579':18A,21A '-189':15A,86B '-2026':17A,20A '-94':58B '10':89B '2026':90B '6.5':30A,34A '9.9':60B 'adob':1A,37B,49B,80B,101C 'adobe':22A,27A,31A 'adobe-experience-manag':36B 'aem':40B 'affect':105C 'allow':62B 'apsb26':14A,85B 'arbitrari':63B,121C,142C 'attack':135C 'authent':41B,68B 'bulletin':84B 'chang':155C 'cloud':25A,43B 'cloud-servic':42B 'code':4A,13A,54B,64B,113C,114C,122C,143C 'context':126C 'control':109C 'could':118C,136C 'current':129C 'cve':16A,19A 'cvss':59B 'cwe':57B 'execut':65B,123C,141C 'experi':2A,38B,50B,102C 'experience':23A,28A,32A 'exploit':97B,137C,144C 'fix':81B 'flaw':56B 'generat':111C 'host':47B 'improp':108C 'inject':5A,55B,115C 'interact':79B,152C 'issu':147C 'know':94B 'let':6A 'low':9A,70B,133C 'low-privileg':8A,69B,132C 'lts':35A 'manag':3A,39B,51B,103C 'manager':24A,29A,33A 'network':75B 'novemb':88B 'privileg':10A,71B,134C 'requir':150C 'result':119C 'run':12A 'say':92B 'scope':153C 'self':46B 'self-host':45B 'servic':44B 'service':26A 'user':11A,72B,78B,130C,151C 'vendor':48B 'vulner':116C,139C 'wild':100B","nicknames":[],"mitigations":[],"who_affected":"Any AEM deployment where a low-privileged account can log in: AEM Cloud Service up to 2026.10.29023, AEM 6.5 up to Service Pack 25, and AEM 6.5 LTS up to Service Pack 3. Adobe's bulletin lists all three as affected for this CVE. Teams that do not run Adobe Experience Manager can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:37:03Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html","run_id":3007},"products":{"at":"2026-11-10T22:37:03Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html","run_id":3007},"who_affected":{"at":"2026-11-10T22:37:03Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html","run_id":3007}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adobeexperiencemanager65","adobeexperiencemanager65lts","adobeexperiencemanagercloudservice","experiencemanager65","experiencemanager65lts","experiencemanagercloudservice"],"ptokens":["adobe","cloud","experience","lts","manager","service"],"labels":["adobeexperiencemanager","aem","authenticated","cloudservice","critical","selfhosted","vendor"],"campaign_type":null,"search_a":"'-113579':18A,21A '-189':15A '-2026':17A,20A '6.5':30A,34A 'adob':1A 'adobe':22A,27A,31A 'apsb26':14A 'cloud':25A 'code':4A,13A 'cve':16A,19A 'experi':2A 'experience':23A,28A,32A 'inject':5A 'let':6A 'low':9A 'low-privileg':8A 'lts':35A 'manag':3A 'manager':24A,29A,33A 'privileg':10A 'run':12A 'service':26A 'user':11A","search_b":"'-189':86B '-94':58B '10':89B '2026':90B '9.9':60B 'adob':37B,49B,80B 'adobe-experience-manag':36B 'aem':40B 'allow':62B 'apsb26':85B 'arbitrari':63B 'authent':41B,68B 'bulletin':84B 'cloud':43B 'cloud-servic':42B 'code':54B,64B 'cvss':59B 'cwe':57B 'execut':65B 'experi':38B,50B 'exploit':97B 'fix':81B 'flaw':56B 'host':47B 'inject':55B 'interact':79B 'know':94B 'low':70B 'low-privileg':69B 'manag':39B,51B 'network':75B 'novemb':88B 'privileg':71B 'say':92B 'self':46B 'self-host':45B 'servic':44B 'user':72B,78B 'vendor':48B 'wild':100B","search_c":"'adob':101C 'affect':105C 'arbitrari':121C,142C 'attack':135C 'chang':155C 'code':113C,114C,122C,143C 'context':126C 'control':109C 'could':118C,136C 'current':129C 'execut':123C,141C 'experi':102C 'exploit':137C,144C 'generat':111C 'improp':108C 'inject':115C 'interact':152C 'issu':147C 'low':133C 'low-privileg':132C 'manag':103C 'privileg':134C 'requir':150C 'result':119C 'scope':153C 'user':130C,151C 'vulner':116C,139C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113579","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113579","severity":null,"published_at":"2026-11-10T22:18:22+00:00","modified_at":"2026-11-10T22:18:22+00:00","first_seen_at":"2026-11-10T22:27:25+00:00","fetched_at":"2026-11-10T22:27:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113579:3007","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html","severity":null,"published_at":"2026-11-10T22:37:03+00:00","modified_at":"2026-11-10T22:37:03+00:00","first_seen_at":"2026-11-10T22:37:03+00:00","fetched_at":"2026-11-10T22:37:03+00:00","note":"Read Adobe APSB26-189 (priority 2, Nov 10 2026): CVE-2026-113579 CWE-94, CVSS 9.9 (AV:N/PR:L/UI:N/S:C), not exploited per Adobe. X/community not searched (X credits depleted per notes; no PoC found). No check written: version/hotfix state is not reliably readable from a repo.","cites":["https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html","https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-130"]}],"documents":[{"id":119679,"url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html","title":"Adobe Security Bulletin APSB26-189: Experience Manager","kind":"advisory","source":"analyst","publisher":null,"text":"Published Nov 10 2026, priority 2. Affected: AEM Cloud Service 2026.10.29023 and earlier; AEM 6.5 SP25 and earlier; AEM 6.5 LTS SP3 and earlier. Fix: CS 2026.10.29251; 6.5 and 6.5 LTS Cumulative Hotfix GRANITE-75052 (6.5 for SP23/24/25; LTS for SP1/2/3). CVE-2026-113580 CWE-94 critical CVSS 9.9. Component and required config not specified. Adobe not aware of exploits in the wild.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":119329,"url":"https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-130","title":"MS-ISAC advisory 2026-130: Adobe products","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}