CVE-2026-90532: Adobe Experience Manager Privilege Escalation

CVE-2026-90532 Overview

CVE-2026-90532 is an Incorrect Authorization vulnerability [CWE-863] affecting Adobe Experience Manager (AEM). The flaw allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user. Successful exploitation can lead to elevated access or control over the victim's account or session. The vulnerability requires no user interaction and is exploitable over the network. Scope is changed, meaning compromise of the vulnerable component affects resources beyond its security authority. Adobe addressed the issue in security bulletin APSB26-152.

Critical Impact

An unauthenticated network attacker can execute arbitrary code and gain control over user accounts or sessions in Adobe Experience Manager deployments.

Affected Products

• Adobe Experience Manager (AEM) — refer to Adobe advisory APSB26-152 for affected versions
• Adobe Experience Manager Cloud Service deployments
• Adobe Experience Manager on-premise installations

Discovery Timeline

• 2026-10-13 - CVE-2026-90532 published to the National Vulnerability Database
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-90532

Vulnerability Analysis

The vulnerability is categorized under [CWE-863] Incorrect Authorization. The authorization logic in Adobe Experience Manager fails to correctly validate whether a requester is permitted to perform a given action. An attacker can send crafted network requests that bypass the intended access controls. Because the scope is changed, the impact crosses the trust boundary of the vulnerable component. Resulting code execution runs in the context of the current user, which can translate to administrative control depending on the active session.

Root Cause

The root cause is improper enforcement of authorization checks on a privileged code path exposed by AEM. The component accepts requests from unauthenticated sources and performs sensitive operations without validating caller permissions. This design flaw allows an external actor to invoke functionality intended only for trusted roles. Specific technical details of the affected endpoint have not been disclosed by Adobe at the time of publication.

Attack Vector

Exploitation occurs over the network and requires no privileges or user interaction. An attacker sends a crafted HTTP request to an exposed AEM instance to trigger the authorization bypass. The resulting code execution operates with the privileges of the current user session, enabling full account takeover. Internet-facing AEM instances are at highest risk due to the network attack vector.

Adobe has not published a public proof-of-concept. Technical details are described in prose only; refer to the Adobe Security Update APSB26-152 for authoritative information.

Detection Methods for CVE-2026-90532

Indicators of Compromise

• Unexpected AEM user accounts with elevated privileges created after the publication date
• Anomalous HTTP POST or PUT requests to AEM administrative or servlet endpoints from unauthenticated sources
• New or modified JCR nodes, OSGi bundles, or scheduled jobs that were not deployed by administrators
• Outbound network connections initiated by the AEM Java process to unfamiliar hosts

Detection Strategies

• Review AEM access logs for suspicious requests to /bin/, /libs/, /crx/, and /system/console/ paths from external addresses
• Correlate authentication logs with privileged action logs to identify operations performed without valid session context
• Hunt for process execution originating from the AEM java process spawning shells or scripting interpreters
• Monitor file system changes within the AEM installation directory and repository data stores

Monitoring Recommendations

• Enable verbose audit logging on AEM Dispatcher and backend instances and forward events to a centralized SIEM
• Alert on process-tree anomalies where the AEM JVM creates child processes such as cmd.exe, bash, or powershell.exe
• Deploy web application firewall rules to flag malformed requests to AEM administrative paths

How to Mitigate CVE-2026-90532

Immediate Actions Required

• Apply the Adobe patches referenced in APSB26-152 to all AEM instances
• Restrict network access to AEM author and administrative interfaces using firewall rules or VPN gating
• Audit AEM user accounts, service accounts, and permissions for unauthorized changes
• Rotate credentials and session tokens for any potentially exposed AEM instance

Patch Information

Adobe released fixes in security bulletin APSB26-152. Administrators should consult the Adobe Security Update APSB26-152 for the full list of affected versions and corresponding patched builds. Apply the vendor-supplied updates to both AEM Author and Publish tiers.

Workarounds

• Place AEM Author instances behind an authenticated reverse proxy or VPN to block unauthenticated internet traffic
• Configure the AEM Dispatcher to deny external access to administrative servlets, consoles, and OSGi endpoints
• Enforce strict allow-lists on URI paths exposed through the Dispatcher to limit the reachable attack surface
• Monitor and rate-limit requests to AEM endpoints while patch deployment is scheduled

# Example AEM Dispatcher filter to deny access to administrative paths
/0100 { /type "deny" /url "/system/*" }
/0101 { /type "deny" /url "/crx/*" }
/0102 { /type "deny" /url "/bin/*" }
/0103 { /type "deny" /url "/libs/granite/core/content/login.*" }