{"id":"CVE-2026-119017","kind":"vulnerability","aliases":["CVE-2026-119017"],"related":[],"title":"Adobe Experience Manager 6.5: incorrect authorization lets low-privileged users run code (not Cloud Service or 6.5 LTS)","description":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","summary":"Adobe bulletin APSB26-189 (Nov 10, 2026) lists CVE-2026-119017 as Incorrect Authorization (CWE-863), CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C). A low-privileged authenticated user can achieve arbitrary code execution. Adobe says AEM 6.5 is affected and fixed by the Cumulative Hotfix for GRANITE-75052; AEM Cloud Service and AEM 6.5 LTS are Not Affected for this CVE. Adobe is not aware of exploitation in the wild.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Experience Manager 6.5","fixed":["Cumulative Hotfix for GRANITE-75052 (SP23, SP24, SP25)"],"affected":"6.5 Service Pack 25 and earlier","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-experience-manager","aem","auth-required","self-hosted","vendor"],"not_affected_if":["aem-6.5-lts","aem-cloud-service","auth-required","managed-hosting"],"how_to_check":"Self-hosted AEM 6.5 only: check the installed service pack (AEM Package Manager / System Console > Product Information). Service Pack 25 and earlier are affected per Adobe; confirm whether the GRANITE-75052 Cumulative Hotfix for your SP is installed (Package Manager). AEM Cloud Service and AEM 6.5 LTS are not affected by this CVE.","fix":"Install the Cumulative Hotfix for GRANITE-75052 matching your AEM 6.5 service pack (SP23, SP24 or SP25) from the APSB26-189 bulletin download links.","status":"open","published_at":"2026-11-10T22:18:24+00:00","first_seen_at":"2026-11-10T22:27:26+00:00","triaged_at":"2026-11-10T22:28:37+00:00","updated_at":"2026-11-10T22:35:43+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-10T22:28:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Adobe Experience Manager: authorization flaw lets low-privileged users run code","impact":"high","summary":"Adobe Experience Manager has an incorrect authorization flaw that lets a low-privileged attacker execute arbitrary code in the context of the current user. No user interaction is needed, and the scope is changed.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["adobe-experience-manager","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary code on the AEM server with low privileges","analyst_note":"Find Adobe's security bulletin for CVE-2026-119017 to get affected and fixed AEM versions, and any required setup.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Adobe Experience Manager, where an account with low privileges could reach code execution. The sources do not list affected versions or configurations, so unknown whether a given deployment is exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000671,"input_tokens":4558,"output_tokens":431,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Adobe's security bulletin for CVE-2026-119017 to get affected and fixed AEM versions, and any required setup.","search":"'-119017':22A,25A,52B '-189':45B '-2026':21A,24A,51B '-75052':91B '-863':57B '10':47B '2026':48B '6.5':4A,18A,29A,80B,97B '9.9':59B 'achiev':73B 'adob':1A,31B,42B,77B,105B,114C 'adobe':26A 'adobe-experience-manag':30B 'aem':34B,79B,92B,96B 'affect':82B,101B,118C 'apsb26':44B 'arbitrari':74B,128C,149C 'attack':142C 'auth':36B 'auth-requir':35B 'authent':70B 'author':6A,55B,122C 'av':60B 'awar':108B 'bulletin':43B 'c':65B 'chang':162C 'cloud':15A,93B 'code':13A,75B,129C,150C 'context':133C 'could':125C,143C 'cumul':87B 'current':136C 'cve':20A,23A,50B,104B 'cvss':58B 'cwe':56B 'execut':76B,130C,148C 'experi':2A,32B,115C 'experience':27A 'exploit':110B,144C,151C 'fix':84B 'granit':90B 'host':40B 'hotfix':88B 'incorrect':5A,54B,121C 'interact':159C 'issu':154C 'l/pr':62B 'l/ui':63B 'let':7A 'list':49B 'low':9A,68B,140C 'low-privileg':8A,67B,139C 'lts':19A,98B 'manag':3A,33B,116C 'manager':28A 'n/ac':61B 'n/s':64B 'nov':46B 'privileg':10A,69B,141C 'requir':37B,157C 'result':126C 'run':12A 'say':78B 'scope':160C 'self':39B 'self-host':38B 'servic':16A,94B 'user':11A,71B,137C,158C 'vendor':41B 'vulner':123C,146C 'wild':113B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Adobe Experience Manager, where an account with low privileges could reach code execution. The sources do not list affected versions or configurations, so unknown whether a given deployment is exposed.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:35:43Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html","run_id":3004},"products":{"at":"2026-11-10T22:35:43Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html","run_id":3004},"how_to_check":{"at":"2026-11-10T22:35:43Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html","run_id":3004},"who_affected":{"at":"2026-11-10T22:35:43Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html","run_id":3004}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adobeexperiencemanager65","experiencemanager65"],"ptokens":["adobe","experience","manager"],"labels":["adobeexperiencemanager","aem","authrequired","critical","selfhosted","vendor"],"campaign_type":null,"search_a":"'-119017':22A,25A '-2026':21A,24A '6.5':4A,18A,29A 'adob':1A 'adobe':26A 'author':6A 'cloud':15A 'code':13A 'cve':20A,23A 'experi':2A 'experience':27A 'incorrect':5A 'let':7A 'low':9A 'low-privileg':8A 'lts':19A 'manag':3A 'manager':28A 'privileg':10A 'run':12A 'servic':16A 'user':11A","search_b":"'-119017':52B '-189':45B '-2026':51B '-75052':91B '-863':57B '10':47B '2026':48B '6.5':80B,97B '9.9':59B 'achiev':73B 'adob':31B,42B,77B,105B 'adobe-experience-manag':30B 'aem':34B,79B,92B,96B 'affect':82B,101B 'apsb26':44B 'arbitrari':74B 'auth':36B 'auth-requir':35B 'authent':70B 'author':55B 'av':60B 'awar':108B 'bulletin':43B 'c':65B 'cloud':93B 'code':75B 'cumul':87B 'cve':50B,104B 'cvss':58B 'cwe':56B 'execut':76B 'experi':32B 'exploit':110B 'fix':84B 'granit':90B 'host':40B 'hotfix':88B 'incorrect':54B 'l/pr':62B 'l/ui':63B 'list':49B 'low':68B 'low-privileg':67B 'lts':98B 'manag':33B 'n/ac':61B 'n/s':64B 'nov':46B 'privileg':69B 'requir':37B 'say':78B 'self':39B 'self-host':38B 'servic':94B 'user':71B 'vendor':41B 'wild':113B","search_c":"'adob':114C 'affect':118C 'arbitrari':128C,149C 'attack':142C 'author':122C 'chang':162C 'code':129C,150C 'context':133C 'could':125C,143C 'current':136C 'execut':130C,148C 'experi':115C 'exploit':144C,151C 'incorrect':121C 'interact':159C 'issu':154C 'low':140C 'low-privileg':139C 'manag':116C 'privileg':141C 'requir':157C 'result':126C 'scope':160C 'user':137C,158C 'vulner':123C,146C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119017","severity":null,"published_at":"2026-11-10T22:18:24+00:00","modified_at":"2026-11-10T22:18:24+00:00","first_seen_at":"2026-11-10T22:27:26+00:00","fetched_at":"2026-11-10T22:27:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119017:3004","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html","severity":null,"published_at":"2026-11-10T22:35:43+00:00","modified_at":"2026-11-10T22:35:43+00:00","first_seen_at":"2026-11-10T22:35:43+00:00","fetched_at":"2026-11-10T22:35:43+00:00","note":"Primary source APSB26-189: only AEM 6.5 affected for this CVE; Cloud Service and 6.5 LTS Not Affected; no exploitation known. Mitigations/social not searched (B tier, fresh).","cites":["https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"]}],"documents":[{"id":119679,"url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html","title":"Adobe Security Bulletin APSB26-189: Experience Manager","kind":"advisory","source":"analyst","publisher":null,"text":"Published Nov 10 2026, priority 2. Affected: AEM Cloud Service 2026.10.29023 and earlier; AEM 6.5 SP25 and earlier; AEM 6.5 LTS SP3 and earlier. Fix: CS 2026.10.29251; 6.5 and 6.5 LTS Cumulative Hotfix GRANITE-75052 (6.5 for SP23/24/25; LTS for SP1/2/3). CVE-2026-113580 CWE-94 critical CVSS 9.9. Component and required config not specified. Adobe not aware of exploits in the wild.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}