Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-113580 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-11 |
| Vendor | Adobe |
| Product | Experience Manager |
| Vulnerability Type | code injection, arbitrary code execution (CWE-94) |
| CVSS Score | 9.9 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Adobe Experience Manager is affected by an Improper Control of Generation of Code (‘Code Injection’) vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
The flaw was published in Adobe bulletin APSB26-189, which also covers CVE-2026-113579, CVE-2026-114371, CVE-2026-119017.
Required Actions
- Update Adobe Experience Manager (AEM 6.5 / AEM as a Cloud Service, depending on your deployment) to the version listed in bulletin APSB26-189.
- Review accounts with access to the author instance — the flaw requires only low privileges, so every editor account is a potential entry point.
- Restrict access to the author instance to the internal network or VPN.
Who Is Affected?
The vulnerability affects Adobe Experience Manager — a CMS/DXP platform used mainly by large enterprises, banks, insurers and telecoms for corporate websites. Bulletin APSB26-189 lists the affected versions.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-113580 vulnerability?
CVE-2026-113580 is a code injection flaw (CWE-94) in Adobe Experience Manager leading to arbitrary code execution. CVSS score: 9.9. Adobe released a fix in bulletin APSB26-189.
Does exploiting CVE-2026-113580 require authentication?
Yes, the attacker needs a low-privileged account. No interaction from another user is required.
How to protect against CVE-2026-113580?
Update Adobe Experience Manager as per bulletin APSB26-189 and restrict access to the author instance.
Who is affected by CVE-2026-113580?
Organizations running Adobe Experience Manager versions listed in bulletin APSB26-189.
