Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-119017 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-11 |
| Vendor | Adobe |
| Product | Experience Manager |
| Vulnerability Type | incorrect authorization, arbitrary code execution (CWE-863) |
| CVSS Score | 9.9 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
The flaw was published in Adobe bulletin APSB26-189, which also covers CVE-2026-113579, CVE-2026-113580, CVE-2026-114371.
Required Actions
- Update Adobe Experience Manager (AEM 6.5 / AEM as a Cloud Service, depending on your deployment) to the version listed in bulletin APSB26-189.
- Review accounts with access to the author instance — the flaw requires only low privileges, so every editor account is a potential entry point.
- Restrict access to the author instance to the internal network or VPN.
Who Is Affected?
The vulnerability affects Adobe Experience Manager — a CMS/DXP platform used mainly by large enterprises, banks, insurers and telecoms for corporate websites. Bulletin APSB26-189 lists the affected versions.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-119017 vulnerability?
CVE-2026-119017 is an incorrect authorization flaw (CWE-863) in Adobe Experience Manager leading to arbitrary code execution. CVSS score: 9.9. Adobe released a fix in bulletin APSB26-189.
Does exploiting CVE-2026-119017 require authentication?
Yes, the attacker needs a low-privileged account. No interaction from another user is required.
How to protect against CVE-2026-119017?
Update Adobe Experience Manager as per bulletin APSB26-189 and restrict access to the author instance.
Who is affected by CVE-2026-119017?
Organizations running Adobe Experience Manager versions listed in bulletin APSB26-189.
