CVE-2026-47991 Details
Description
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Redirect (Open Redirect) vulnerability that could result in a Security feature bypass. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site. Exploitation of this issue requires user interaction in that a victim must click on a malicious link. Scope is changed.
A vulnerability allowing improper redirects (open redirects) has been identified in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04 and earlier. This vulnerability could lead to account takeover, as an attacker could create a malicious URL that redirects a victim to an attacker-controlled site. Exploitation requires user interaction, as the victim must click on the malicious link.
Users are advised to update to Adobe Experience Manager 6.5 LTS Service Pack 2, 6.5 Service Pack 25, or AEM Cloud Service Release 2026.05. Instructions for updating can be found in the release notes for each version.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| adobe experience manager | < 6.5.25.0 < 2026.5.0 6.5 - 6.5 sp1 |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 28, 2026 | CVE Modified | [email protected] |
| Aug 24, 2026 | CVE Modified | [email protected] |
| Aug 7, 2026 | Modified Analysis | [email protected] |
| Aug 6, 2026 | CVE Modified | [email protected] |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 10, 2026 | Initial Analysis | [email protected] |
| Jun 9, 2026 | New CVE Received | [email protected] |