CVE-2026-110084: Adobe Experience Manager Auth Bypass

CVE-2026-110084 Overview

CVE-2026-110084 is an XML Injection vulnerability, commonly known as Blind XPath Injection [CWE-91], affecting Adobe Experience Manager (AEM). The flaw allows a low-privileged attacker to bypass security controls and gain unauthorized read access along with limited write capability. Exploitation occurs over the network and requires no user interaction. Adobe disclosed the issue in security advisory APSB26-152.

Critical Impact
An authenticated attacker with low privileges can bypass AEM security controls through crafted XPath expressions, leading to unauthorized data access and limited modification of application state.

Affected Products

Adobe Experience Manager (AEM) — refer to Adobe advisory APSB26-152 for affected versions
Adobe Experience Manager Cloud Service deployments
Adobe Experience Manager on-premises installations

Discovery Timeline

2026-10-13 - CVE-2026-110084 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110084

Vulnerability Analysis

The vulnerability resides in how Adobe Experience Manager processes XML input used to construct XPath queries. When user-controlled data flows into an XPath expression without proper sanitization or parameterization, an attacker can alter the structure of the query. This manipulation changes the logic of security checks that AEM performs against its content repository.

Because the injection is blind, the attacker does not receive direct query output. Instead, they infer results from differences in application behavior, response codes, or timing. This technique allows systematic extraction of repository content and metadata that should remain inaccessible to the attacker's role.

The advisory indicates the attacker gains both unauthorized read access and limited write access. Limited write capability suggests the injection can influence certain decision paths that control node creation or property updates in the Java Content Repository (JCR) backing AEM.

Root Cause

The root cause is improper neutralization of data within XPath expressions, classified under CWE-91: XML Injection (aka Blind XPath Injection). AEM relies on XPath queries against its JCR for content lookup and access decisions. When input sanitization is incomplete, attacker-supplied strings close existing predicates and append additional conditions that bypass authorization checks.

Attack Vector

The attack vector is network-based and requires low-privileged authenticated access to the AEM instance. An attacker submits crafted parameters to AEM endpoints that build XPath queries from request data. By injecting XPath operators, functions, and boolean conditions, the attacker enumerates repository nodes and attribute values one character at a time, inferring values from the application's observable behavior.

No verified public proof-of-concept is available at the time of publication. See the Adobe Security Advisory APSB26-152 for vendor technical details.

Detection Methods for CVE-2026-110084

Indicators of Compromise

Repeated HTTP requests to AEM endpoints containing XPath metacharacters such as ', ], [, or, and, string-length(, substring(, or count( in query parameters or POST bodies
Spikes in authenticated low-privileged account activity targeting content query, search, or JCR servlet endpoints like /bin/querybuilder.json or /content/.*.json
Unusual sequences of near-identical requests that differ only in a single character position, consistent with blind inference
Access patterns reaching repository paths outside the user's normal role scope

Detection Strategies

Enable verbose request logging on AEM dispatcher and publish instances to capture query parameters feeding XPath contexts
Deploy Web Application Firewall rules that flag XPath syntax tokens appearing in parameters not expected to contain them
Correlate authentication logs with repository access logs to identify low-privileged sessions performing high-volume query enumeration
Baseline normal query patterns per user role and alert on statistical deviation in request volume or path diversity

Monitoring Recommendations

Forward AEM request.log, access.log, and error.log to a centralized analytics platform for retention and correlation
Monitor for unauthorized read operations against sensitive JCR paths including /conf, /apps, and /etc/users
Track account behavior for low-privileged users initiating writes to nodes outside their assigned content branches
Alert on repeated 200 OK responses interleaved with 403 or 404 responses from the same session, a pattern consistent with blind oracle probing

How to Mitigate CVE-2026-110084

Immediate Actions Required

Apply the Adobe security updates listed in APSB26-152 to all affected AEM instances
Audit AEM user accounts and revoke unnecessary low-privileged accounts that could be weaponized for exploitation
Review dispatcher filter rules to restrict access to query and search endpoints from untrusted networks
Rotate credentials for any service accounts that interact with AEM authoring or publish tiers

Patch Information

Adobe published security advisory APSB26-152 with remediated builds for Adobe Experience Manager. Administrators should consult the advisory for the specific service pack, hotfix, or cloud service release that addresses CVE-2026-110084 and apply updates following Adobe's recommended deployment procedure. Full details are available in the Adobe Security Advisory APSB26-152.

Workarounds

Restrict access to AEM authoring instances behind VPN or IP allowlists to limit the attacker population to trusted networks
Harden dispatcher configuration to block requests containing XPath syntax tokens in parameters that should accept only alphanumeric input
Enforce the principle of least privilege by auditing JCR ACLs and removing excessive read or write permissions from low-privileged groups
Enable rate limiting on query endpoints to slow blind enumeration attempts and generate detectable signal

bash

# Example dispatcher filter restricting query parameter characters
/0100 { /type "deny" /url ".*" /query ".*[\\[\\]'\"\\(\\)].*" }
/0101 { /type "allow" /method "GET" /url "/content/.*" }