CVE-2026-48382: Critical AEM Auth Flaw Enables Code Execution Without User Interaction

Adobe Experience Manager products are affected by a critical authorization flaw that enables arbitrary code execution. The vulnerability requires no user interaction, allowing attackers to gain elevated access to victim accounts or sessions.

What happened

The National Vulnerability Database lists CVE-2026-48382 as an incorrect authorization vulnerability with a CVSS score of 10.0. This flaw allows for arbitrary code execution in the context of the current user. Attackers can potentially gain control over the victim's account or session without any interaction from the user. The scope of the vulnerability is changed, indicating broader impact.

Affected products include Adobe Experience Manager as a Cloud Service versions up to 2026.9.28187. Adobe Experience Manager 6.5 LTS versions up to 6.5 LTS SP3 are also vulnerable. Additionally, Adobe Experience Manager 6.5 versions up to 6.5.25 are impacted by this issue. The weakness is classified under CWE-863.

The source material lists specific affected version ranges for these products. It does not state that a patch or update has been released. The records only define the scope of the vulnerability. There is no information provided regarding remediation status.

Why it matters

The ability to execute arbitrary code without user interaction significantly raises the risk profile. Attackers do not need to trick users into clicking links or opening files. This allows for automated exploitation attempts against exposed systems. The potential for gaining elevated access means attackers could compromise sensitive data.

For IT managers, the lack of confirmed patch information creates an urgent need for mitigation. Systems running the affected versions are vulnerable until a fix is provided. The critical CVSS score highlights the severity of the potential impact. Organizations must assess their exposure immediately to prevent unauthorized access.

What to watch

• Monitor Adobe security advisories for patch releases.
• Check internal logs for unusual code execution patterns.
• Review access controls for affected user accounts.
• Watch for changes in session permissions or elevated access.

Who needs to act first

Teams should prioritize systems exposed to the internet for immediate review. Isolate vulnerable instances from critical networks where possible. Ensure backups are current before making any configuration changes. Validate that monitoring tools are active to detect exploitation attempts. Limit access to administrative accounts to reduce potential impact. Coordinate with security operations to watch for anomalous behavior. Do not attempt to patch until official guidance is released. Focus on containment and visibility in the interim.

What to do and how to stay safe: Adobe Experience Manager

• Identify all instances of affected Adobe Experience Manager versions in your environment.
• Restrict network access to vulnerable systems to limit exposure.
• Monitor server logs for signs of unauthorized code execution.
• Prepare to apply updates once the vendor confirms a fix is available.

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which CVE identifier corresponds to this Adobe Experience Manager flaw?

The vulnerability is identified as CVE-2026-48382.

Is there a patch available for CVE-2026-48382?

The source material does not confirm that a patch or update exists.

Which Adobe Experience Manager versions are affected?

Versions up to 2026.9.28187 for Cloud Service, 6.5 LTS SP3, and 6.5.25 are affected.