#NØØT_Security_Alerts 🚨 #ALERT — ADOBE EXPERIENCE MANAGER CVSS 10.0: CRITICAL AUTHORIZATION FAILURE ENABLES REMOTE CODE EXECUTION October 13, 2026 DISCLOSED BY: Adobe Security PRODUCT: Adobe Experience Manager (AEM) CVE: CVE-2026-90532 SEVERITY: CRITICAL — CVSS 3.1: 10.0 WEAKNESS: CWE-863 — Incorrect Authorization AFFECTED VERSIONS: AEM Cloud Service 2026.9.28187 and earlier. AEM 6.5 Service Pack 25 and earlier. AEM 6.5 LTS Service Pack 3 and earlier. IMPACT: Incorrect authorization controls could allow remote attackers to execute arbitrary code on vulnerable AEM deployments. EXPOSURE: Network-reachable affected services. Adobe’s CVSS vector specifies low attack complexity, no authentication requirement and no user interaction. EXPLOITATION STATUS: VENDOR-CONFIRMED CRITICAL RCE. Adobe reports no known exploitation in the wild. No independently verified public working PoC has been established. Forensic triage: Review AEM request logs for anomalous requests, unexpected administrative operations and suspicious application changes. Investigate unexplained processes launched by AEM services and unauthorized filesystem modifications. Preserve relevant security and application logs. No confirmed CVE-specific malicious IOCs have been published. URGENT ACTION: Verify that AEM Cloud Service is running fixed build 2026.9.28386 or later. For AEM 6.5 and AEM 6.5 LTS, apply Adobe’s GRANITE-72352 security hotfix. Confirm deployment of the appropriate hotfix for each affected environment. Restrict unnecessary exposure and investigate suspicious historical activity. SOURCE: https://www.adobe.com/trust/security/products/experience-manager/apsb26-152.html CONFIDENCE: HIGH — Adobe’s October 13 security bulletin confirms the authorization vulnerability, unauthenticated execution risk, affected installations and remediation requirements. Real-world exploitation remains unverified. #CyberSecurity #ThreatIntel #Adobe #AEM #RCE #EnterpriseSecurity
