CVE-2026-119017

Summary

Adobe Experience Manager contains an Incorrect Authorization (CWE-863) flaw allowing low-privileged users to bypass intended access controls and execute arbitrary code in their own context. The vulnerability affects the scope of authorization enforcement, enabling privilege escalation without user interaction.

Exploitability

Exploitation requires only low-privileged access and no user interaction, making it highly exploitable by authenticated attackers with minimal privileges.

Blast radius

Successful exploitation could lead to full compromise of the AEM instance, including data theft, unauthorized code execution, and potential lateral movement within the environment.

Detection

Monitor for unusual POST requests to /bin/wcmcommand.json or replication agent endpoints from non-administrative users in AEM logs; look for unexpected Java process spawns or execution of uncommon scripts via the AEM author instance logs. No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Adobe Experience Manager 6.5.20 or later, as patched in Adobe's April 2026 Security Updates; if unable to patch immediately, restrict access to /bin/wcmcommand.json and /etc/replication/agents.author/* endpoints to administrators only.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.