CVE-2026-113580

Summary

Adobe Experience Manager contains a code injection vulnerability (CWE-94) allowing low-privileged attackers to execute arbitrary code in the context of the current user due to improper control of code generation. The vulnerability is exploitable remotely without user interaction and has a changed scope, increasing its severity to CVSS 9.9.

Exploitability

Exploitation requires only low privileges and no user interaction, making it highly exploitable for compromised or insider attackers with minimal access.

Blast radius

Successful exploitation could lead to full system compromise including data theft, unauthorized code execution, and lateral movement within the Adobe Experience Manager environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Adobe Experience Manager version 6.5.2023.12.0 or later (as per Adobe Security Advisory APSB24-42); if no fixed version is available for your specific branch, immediately restrict access to AEM endpoints via network segmentation and disable non-essential user-facing code execution features pending patching.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.