CVSS 9.9 AEM 6.5 Flaw Enables Remote Code Execution Without User Interaction

Adobe has disclosed a critical authorization flaw in its Experience Manager platform. The vulnerability, tracked as CVE-2026-75732, affects widely deployed versions of the software.

What happened

Adobe Experience Manager is affected by an incorrect authorization vulnerability identified as CVE-2026-75732. According to the National Vulnerability Database, this flaw is rated with a CVSS score of 9.9, which classifies it as critical. The weakness stems from CWE-863, where the software fails to properly restrict access to sensitive functionality.

The vulnerability allows for arbitrary code execution within the context of the current user. An attacker could potentially gain elevated access or control over the victim’s account or session. Crucially, exploitation of this issue does not require any user interaction, making it a significant remote risk for exposed systems.

Why it matters

This flaw impacts specific versions of Adobe Experience Manager that are still in active use. Affected products include Adobe Experience Manager 6.5 LTS up to Service Pack 3. Additionally, standard Adobe Experience Manager 6.5 versions up to 6.5.25 are listed as affected in the advisory.

The scope of the vulnerability is changed, indicating that the impact extends beyond the immediate component. Since no user interaction is needed, attackers can exploit the flaw remotely if the system is accessible. This increases the attack surface for organizations running these specific legacy or long-term support versions.

What to watch

• Check if your AEM instances are running version 6.5 LTS SP3 or earlier.
• Verify if standard AEM 6.5 instances are at version 6.5.25 or older.
• Monitor network traffic for unusual execution patterns on exposed endpoints.
• Review logs for unauthorized access attempts to sensitive administrative functions.

Who needs to act first

Teams should immediately inventory all instances of Adobe Experience Manager 6.5 to determine exposure. Prioritize systems that are internet-facing or accessible from untrusted networks, as they face the highest risk. Verify whether current versions fall within the affected range before proceeding with mitigation. Implement strict network segmentation to limit access to these systems while evaluating options. Ensure backups are current and tested to allow for rapid recovery if compromise occurs. Review firewall rules to block unnecessary external traffic to administrative interfaces.

What to do and how to stay safe: Adobe

• Audit all AEM 6.5 installations to confirm if they are running affected versions.
• Restrict network access to AEM instances to trusted IP addresses only.
• Monitor authentication logs for signs of unauthorized access or privilege escalation.
• Prepare to isolate affected systems once the vendor provides an update.

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Adobe Experience Manager are affected by CVE-2026-75732?

Adobe Experience Manager 6.5 LTS up to 6.5 LTS SP3 and Adobe Experience Manager 6.5 up to 6.5.25 are affected.

Is there a patch available for this vulnerability?

No fix has been confirmed yet; the source material only lists affected versions.

Does exploiting this vulnerability require user interaction?

No, exploitation of this issue does not require user interaction according to the advisory.