CVE-2026-90531
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation.
Published Oct 13, 2026 · updated Oct 14, 2026 · Adobe Adobe Experience Manager as a Cloud Service
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · NIST NVD
Detected
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
Oct 14, 2026 · NIST NVD
Updated
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
Affected
- vendor Adobe Adobe Experience Manager 6.5version unspecified
- vendor Adobe Adobe Experience Manager 6.5 LTSversion unspecified
- vendor Adobe Adobe Experience Manager as a Cloud Serviceversion unspecified
Sources
- CIRCL Vulnerability LookupCVE-2026-90531
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation
vulnerability.circl.lu - CVE.orgCVE-2026-90531
Official CVE identifier
cve.org - NIST NVDCVE-2026-90531
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation
nvd.nist.gov