External risk intelligence

Adobe Experience Manager Incorrect Authorization Leading to Arbitrary Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-119017

Adobe Experience Manager is a web content management system typically deployed as a public-facing web application or edge service to serve digital content, making it commonly accessible via the internet in standard enterprise configurations.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects Adobe Experience Manager, a system used for managing digital content. A low-privileged attacker could potentially execute arbitrary code, leading to significant compromise without requiring user interaction. The main concern is confirming if our organization uses this affected technology and understanding the potential exposure.

Unauthorized code execution risk.
Affects digital content management.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with low privileges could exploit this vulnerability in Adobe Experience Manager. By leveraging an improper authorization flaw, they could execute arbitrary code within the context of the current user, potentially leading to a complete system compromise. This attack does not require any action from a user.

Requires low-privileged access.
Exploits improper authorization.
Leads to arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Adobe Experience Manager could allow a low-privileged attacker to execute arbitrary code on the system. When exploited, this could lead to unauthorized code execution within the context of the current user, potentially impacting the confidentiality, integrity, and availability of the affected system.

System data could be compromised.
Attacker executes code via network.
Potential for full system takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership

Application owners and infrastructure teams are typically responsible for Adobe Experience Manager, with security teams involved in assessing and mitigating risks. The first practical step is to identify all instances of Adobe Experience Manager, determine their exposure to external networks, and confirm their business criticality to prioritize remediation efforts. Coordination with the vendor for any available fixes or guidance will also be essential.

Application owners and infrastructure teams.
Confirm AEM instance exposure and criticality.
Plan remediation based on validated risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe Experience Manager?

Adobe Experience Manager is a comprehensive content management system used by enterprises to create, manage, and deliver digital marketing content and web experiences across various channels. It acts as the backbone for public-facing websites and internal digital platforms, housing sensitive assets and organizational data that require strictly controlled access.

What does Incorrect Authorization mean for CVE-2026-119017?

This vulnerability, classified as CWE-863, occurs when a system fails to properly verify if a user has the necessary permissions to perform a specific action. In the context of CVE-2026-119017, it allows an attacker with low-level privileges to bypass these checks, enabling them to execute arbitrary code as if they had higher authority within the system.

How does an attacker trigger this vulnerability?

An attacker triggers this issue by sending malicious requests over the network that the system improperly authorizes. Crucially, this exploit path does not require any interaction from legitimate users, such as clicking a link or opening a file; the system accepts and processes the unauthorized commands directly.

Is my instance of Adobe Experience Manager at risk?

According to Halo Surface Signal, this software is typically deployed as a public-facing web application or edge service to serve content, making it highly likely to be accessible via the internet. If your instance is reachable from an external network, it may be at a higher risk of being targeted than systems restricted to internal-only segments.

What is the first step to address CVE-2026-119017?

Begin by auditing your infrastructure to create a complete inventory of all Adobe Experience Manager instances. Once identified, evaluate the network accessibility and business criticality of each instance to prioritize your response, then coordinate with your infrastructure team to obtain and apply security updates provided by the vendor.

References

www.adobe.com/trust/security/products/experience-manager/apsb26-189…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.