Adobe AEM 6.5 Faces Critical Auth Bypass Enabling Remote Code Execution

Adobe Experience Manager contains a severe authorization defect that permits remote code execution without requiring any action from the user. This vulnerability, tracked as CVE-2026-75732, affects specific versions of the 6.5 release line, including the Long Term Support branch up to Service Pack 3. Security teams managing these installations face immediate exposure risks because the flaw allows attackers to operate within the context of the current user.

What is the technical scope of this flaw?

The National Vulnerability Database classifies CVE-2026-75732 as a Critical severity issue with a CVSS score of 9.9. The underlying weakness is categorized under CWE-863, which relates to incorrect authorization. According to the advisory, the vulnerability allows an attacker to execute arbitrary code. This execution happens in the context of the current user, potentially allowing the attacker to gain elevated access or take control of the victim's account or session.

Which software versions are affected?

The vulnerability impacts Adobe Experience Manager 6.5 LTS versions up to and including 6.5 LTS SP3. It also affects the standard Adobe Experience Manager 6.5 releases up to version 6.5.25. Organizations running any of these specific builds are considered vulnerable. Systems running newer versions or different major releases are not listed in the affected scope provided by the National Vulnerability Database.

How does the exploitation work?

Exploitation of this authorization issue does not require user interaction. An attacker can trigger the flaw remotely without needing the target to click a link or open a file. The scope of the vulnerability is described as changed, indicating that the impact extends beyond the initial data or object. Successful exploitation could result in the attacker gaining control over the victim's account or session, depending on the permissions of the compromised user context.

What is the current remediation status?

No patch, fix, or update has been confirmed yet in the available source material. The National Vulnerability Database record describes the vulnerability and its affected versions but does not mention a released solution. Security operations teams should monitor official Adobe channels for further guidance. Until a fix is provided, organizations must rely on compensating controls and network segmentation to limit exposure.

Questions to ask your suppliers

Security leaders should immediately engage vendors supporting content management infrastructure to verify their exposure. Ask whether any managed services or hosted environments utilize the affected Adobe Experience Manager versions. Determine who within the organization owns the patching lifecycle for these systems and whether emergency maintenance windows can be opened. Check if suppliers have detected anomalous traffic patterns indicative of exploitation attempts. Ensure that incident response plans account for potential session hijacking. Communicate the risk level to executive stakeholders to justify potential operational disruptions during mitigation efforts.

What to do and how to stay safe: Adobe

• Inventory all instances of Adobe Experience Manager to identify those running affected 6.5 versions.
• Restrict network access to these systems to limit exposure from untrusted sources.
• Monitor logs for unusual administrative actions or session anomalies that could indicate exploitation.
• Prepare to apply updates immediately once the vendor provides a confirmed patch.

Step-by-step guide: Vulnerability Scanning: What It Finds and What It Misses

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-75732?

The National Vulnerability Database assigns a CVSS score of 9.9, rating it as Critical.

Does exploiting this vulnerability require user interaction?

No, the source material states that exploitation does not require user interaction.

Which specific versions of AEM 6.5 are affected?

AEM 6.5 LTS up to SP3 and standard AEM 6.5 up to version 6.5.25 are affected.