CVE-2026-114371

Summary

Adobe Experience Manager contains an Incorrect Authorization (CWE-863) vulnerability allowing low-privileged users to bypass intended access controls and execute arbitrary code in their own context. The flaw enables privilege escalation without user interaction due to improper scope enforcement during authorization checks.

Exploitability

Exploitation requires only low-privileged access and no user interaction, making it highly exploitable for compromised or insider accounts with minimal permissions.

Blast radius

Successful exploitation could lead to full compromise of the AEM instance—including data theft, code injection, and lateral movement—since the attacker gains arbitrary code execution within the application's runtime context.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Adobe Experience Manager 6.5.17.0 or later, as patched in Adobe Security Advisory APSB26-14 (published 2026-03-18).

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.