CVE-2026-48288 Details
Description
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.
A vulnerability allowing security feature bypass has been identified in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04 and earlier. This vulnerability arises from improper input validation, which could enable a low-privileged attacker to bypass security measures and gain unauthorized write access. Exploitation requires user interaction, as a victim must visit a maliciously crafted URL or engage with a compromised web page.
Users are advised to update to Adobe Experience Manager 6.5 LTS Service Pack 2, 6.5 Service Pack 25, or AEM Cloud Service Release 2026.05. Instructions for updating can be found in the release notes for each version.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| adobe experience manager | < 6.5.25.0 < 2026.5.0 6.5 - 6.5 sp1 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 28, 2026 | CVE Modified | [email protected] |
| Aug 24, 2026 | CVE Modified | [email protected] |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 10, 2026 | Initial Analysis | [email protected] |
| Jun 9, 2026 | New CVE Received | [email protected] |