---
id: "CVE-2026-113579"
page: "https://infrastack.ai/live/CVE-2026-113579"
kind: "vulnerability"
aliases: ["CVE-2026-113579"]
title: "Adobe Experience Manager: code injection lets a low-privileged user run code (APSB26-189)"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Adobe Experience Manager Cloud Service", "fixed": ["2026.10.29251"], "affected": "<= 2026.10.29023", "ecosystem": "vendor"}, {"name": "Adobe Experience Manager 6.5", "fixed": ["Cumulative Hotfix for GRANITE-75052"], "affected": "<= SP25", "ecosystem": "vendor"}, {"name": "Adobe Experience Manager 6.5 LTS", "fixed": ["Cumulative Hotfix for GRANITE-75052"], "affected": "<= SP3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adobe-experience-manager", "aem", "authenticated", "cloud-service", "self-hosted", "vendor"]
not_affected_if: ["no-aem"]
published_at: "2026-11-10T22:18:22+00:00"
first_seen_at: "2026-11-10T22:27:25+00:00"
updated_at: "2026-11-10T22:37:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113579", "first_seen_at": "2026-11-10T22:27:25+00:00"}, {"source": "analyst", "url": "https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html", "first_seen_at": "2026-11-10T22:37:03+00:00", "cites": ["https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html", "https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-130"]}]
exploit_sources: []
---

# Adobe Experience Manager: code injection lets a low-privileged user run code (APSB26-189)

Link for people: https://infrastack.ai/live/CVE-2026-113579 (this .md is for agents)

Adobe Experience Manager has a code injection flaw (CWE-94, CVSS 9.9) that allows arbitrary code execution for an authenticated low-privileged user over the network, with no user interaction. Adobe fixed it in bulletin APSB26-189 on November 10, 2026 and says it knows of no exploitation in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Experience Manager Cloud Service affected <= 2026.10.29023 fixed 2026.10.29251
- vendor:Adobe Experience Manager 6.5 affected <= SP25 fixed Cumulative Hotfix for GRANITE-75052
- vendor:Adobe Experience Manager 6.5 LTS affected <= SP3 fixed Cumulative Hotfix for GRANITE-75052

## How to check

Self-hosted 6.5 or 6.5 LTS: check whether the Cumulative Hotfix for GRANITE-75052 is installed on your Service Pack (6.5 SP23-SP25, 6.5 LTS SP1-SP3) via the Package Manager / installed packages. AEM as a Cloud Service: check the running release; versions 2026.10.29023 and earlier are affected.

## Fix

AEM Cloud Service: update to release 2026.10.29251. AEM 6.5 (SP23, SP24, SP25) and AEM 6.5 LTS (SP1, SP2, SP3): install the matching Cumulative Hotfix for GRANITE-75052 from the bulletin.

## Timeline

- 2026-11-10T22:27:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113579
- 2026-11-10T22:37:03+00:00 analyst https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html — Read Adobe APSB26-189 (priority 2, Nov 10 2026): CVE-2026-113579 CWE-94, CVSS 9.9 (AV:N/PR:L/UI:N/S:C), not exploited per Adobe. X/community not searched (X credits depleted per notes; no PoC found). No check written: version/hotfix state is not reliably readable from a repo.

## Documents

- [advisory] Adobe Security Bulletin APSB26-189: Experience Manager https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html
- [mentions] MS-ISAC advisory 2026-130: Adobe products https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-130

## From the sources

Adobe Experience Manager is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_