Organisations Urged to Patch AEM 6.5 Against Critical CVE-2026-75732 Allowing Silent Remote Code Execution

Remote attackers can execute arbitrary code on Adobe Experience Manager servers without triggering any user action. The National Vulnerability Database identifies this as CVE-2026-75732, an incorrect authorization vulnerability that compromises the integrity of the application. According to the advisory, the flaw allows execution in the context of the current user, potentially leading to elevated access or control over the victim's account or session.

Which Adobe versions are affected?

The vulnerability impacts specific long-term support and standard release lines of Adobe Experience Manager. According to the NVD record, Adobe Experience Manager 6.5 LTS versions up to and including SP3 are vulnerable. Additionally, standard releases of Adobe Experience Manager 6.5 up to and including version 6.5.25 are affected by this incorrect authorization issue.

How severe is this vulnerability?

Security researchers and databases rate the severity based on the ease of exploitation and potential impact. The National Vulnerability Database assigns a CVSS score of 9.9 to CVE-2026-75732, categorizing the severity as critical. The weakness is linked to CWE-863, indicating an error in authorization logic that allows unauthorized actions to be performed.

Does exploitation require user interaction?

No, the source material states clearly that exploitation of this issue does not require user interaction. This means an attacker can trigger the vulnerability remotely without needing a user to click a link, open a file, or perform any other action. The scope of the vulnerability is listed as changed.

What is the potential impact?

Successful exploitation could result in arbitrary code execution in the context of the current user. According to the NVD description, this may allow an attacker to gain elevated access or control over the victim's account or session. The flaw stems from incorrect authorization, which fails to properly validate permissions before allowing certain operations.

What analysts watch for

Teams usually monitor web server logs for unusual POST requests or unauthorized access attempts to sensitive endpoints. Analysts check whether any unexpected scripts or commands were executed by the application user account. They examine session tokens for signs of hijacking or unexpected privilege changes. Monitoring for outbound connections from the application server can reveal command-and-control communication. Reviewing file integrity on the server helps detect new or modified binaries.

Background: National Vulnerability Database

The National Vulnerability Database lists known flaws but lacks deployment context. Do not treat every entry as an immediate emergency. Cross-reference findings with your asset inventory and usage patterns to determine real risk, rather than reacting to every new identifier.

Read the full guide: National Vulnerability Database: Five Common Misreadings and Fixes

What to do and how to stay safe: Adobe Experience Manager

• Verify if your Adobe Experience Manager instances are running versions 6.5 LTS through SP3 or 6.5 through 6.5.25.
• Review server logs for unauthorized access attempts or unexpected code execution patterns in the current user context.
• Restrict network access to Adobe Experience Manager management interfaces to trusted IP addresses only.
• Monitor for signs of session hijacking or unauthorized elevation of privileges within the application.

Step-by-step guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-75732?

It is an incorrect authorization vulnerability in Adobe Experience Manager that allows arbitrary code execution without user interaction.

Which versions of Adobe Experience Manager are affected?

Versions 6.5 LTS up to SP3 and 6.5 up to 6.5.25 are affected according to the National Vulnerability Database.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-75732 with a CVSS score of 9.9, classifying it as critical.