CVE-2026-75732

Executive Summary

CVE-2026-75732 is an Incorrect Authorization vulnerability in Adobe Experience Manager (AEM) rated 9.9 (Critical) on CVSS v3.1. An authenticated attacker with low privileges can exploit the flaw over the network without user interaction to achieve arbitrary code execution in the context of the current user, with a Scope Change (S:C) indicating the attacker can pivot beyond the vulnerable component into other security authorities. Because the issue is currently UNPATCHED and no public PoC or Nuclei template exists, exposure is limited to organizations running AEM in internet- or partner-accessible deployments, but the impact when exploited is total compromise of confidentiality, integrity, and availability.

Technical Analysis

The vulnerability is classified as CWE-863: Incorrect Authorization. In the AEM architecture, authorization is enforced through the Granite/JCR permission model, in which principals (users, groups) are granted privileges via Access Control Lists (ACLs) and Access Control Entries (ACEs) evaluated against repository paths. An Incorrect Authorization flaw means the application fails to correctly verify that the authenticated principal holds the privileges required for the requested operation — for example, an authorization check that is missing, evaluates the wrong principal, is performed after the sensitive action, or can be bypassed by crafting a request that reaches a handler without traversing the intended ACL enforcement point.

The CVSS vector provides the definitive characteristics of the flaw:

• AV:N — attack is delivered over the network; no local access or physical positioning required.
• AC:L — no special conditions, race windows, or unusual configuration are needed.
• PR:L — the attacker must possess some form of authenticated session, but only low privileges are required. In AEM terms, this is consistent with a minimally provisioned account, not necessarily an administrator.
• UI:N — no victim interaction is needed; exploitation is fully attacker-driven.
• S:C — Scope is Changed. The vulnerable component's exploitation affects resources beyond its own security authority. In AEM this is significant: an authorization bypass within one application boundary can reach the underlying JCR repository, the Java runtime, or other services hosted on the same infrastructure.
• C:H / I:H / A:H — high impact to confidentiality, integrity, and availability, consistent with the NVD description that exploitation "could result in arbitrary code execution in the context of the current user."

The combination of PR:L with arbitrary code execution is what makes this rating critical: an attacker does not need administrative credentials to reach code execution, only a foothold account that the flawed authorization logic fails to properly constrain. Because authorization is the gate between "authenticated low-privilege user" and "code execution context," the defect is not in an input parser but in the trust boundary itself.

Insufficient technical detail is available in the source data to identify the specific servlet, API endpoint, OSGi bundle, or ACL check that is defective. No CNA title, affected version range, CPE data, or patch reference was provided. The technical analysis therefore correctly remains at the vulnerability-class level: a missing or incorrect authorization decision allows a low-privileged authenticated principal to invoke functionality or reach an execution context it should not be permitted to access.

Exploitation Scenarios

Because no public PoC, exploit code, or Nuclei template exists, the following attack chain is inferred strictly from the vulnerability class (CWE-863) and the CVSS characteristics supplied above. No specific endpoint names, servlet paths, or parameter names are asserted, as none appear in the source description.

1. Reconnaissance and target identification. The attacker identifies an internet- or partner-facing Adobe Experience Manager instance (for example via Shodan dorks targeting AEM product signatures or AEM login page titles). The attacker maps whether the deployment exposes author, publish, or dispatcher tiers, and confirms the AEM version where possible from response headers or static asset fingerprints.

2. Obtaining a low-privilege foothold. Consistent with PR:L, the attacker requires an authenticated session. This may be obtained through self-registration where enabled, a provisioned but minimally privileged account, reused or leaked credentials, or any other means of acquiring a legitimate low-privilege session. No credential theft exploit is part of this CVE itself — the flaw assumes the attacker already holds a low-privileged session.

3. Triggering the authorization defect. Using that authenticated session, the attacker issues requests to a functionality that is insufficiently protected by the AEM authorization layer. Because the defect is Incorrect Authorization rather than injection, the payload is not necessarily malformed input — it is a request that reaches a privileged operation while the authorization check either does not execute or evaluates incorrectly. The attacker iterates over accessible functionality (AV:N, AC:L, UI:N) until reaching a path where the missing check permits execution.

4. Payload and execution. Once the authorization bypass is traversed, the resulting arbitrary code execution occurs "in the context of the current user." The Scope Change (S:C) indicates the execution context and its privileges extend beyond the directly vulnerable component — in AEM this typically means reaching the JCR repository, the Java/OSGi runtime, or colocated services, enabling the attacker to "gain elevated access or control over the victim's account or session" as described by NVD.

5. Post-exploitation impact. With C:H/I:H/A:H and S:C, a successful exploit yields full read access to content and repository data, the ability to modify or destroy that data, and the ability to disrupt availability of the AEM service. Arbitrary code execution in the application runtime additionally enables persistence mechanisms and lateral movement to systems trusting the AEM instance. Note that no exploit code, PoC, or in-the-wild exploitation has been observed or reported to date.

Impact Assessment

The CVSS base score of 9.9 reflects near-maximum severity. The exploitability subscore is high despite PR:L because the attack is fully network-delivered (AV:N), requires no special conditions (AC:L), and requires no victim interaction (UI:N); the only friction is the need for a low-privileged authenticated session. The impact subscores are all High (C:H/I:H/A:H), meaning successful exploitation compromises the confidentiality, integrity, and availability of affected data and services completely. The Scope Change (S:C) elevates the true blast radius beyond the vulnerable AEM component: an attacker who converts a low-privilege session into code execution can affect resources under different security authorities, including the JCR content repository, the Java runtime, backend integrations, and possibly adjacent services on the same host or network segment. For a business, this translates to potential exposure of all managed web content and digital assets, unauthorized modification of published material, service outage, and downstream compromise of systems that trust AEM. Because there is no patch and no workaround, every internet-exposed AEM deployment with any authenticated user population should be considered at risk until vendor guidance is available.

Detection Guidance

Sigma Rule

title: Adobe Experience Manager Incorrect Authorization Exploitation Attempt (CVE-2026-75732)
id: 7c4e1a92-3b6d-4f0e-9a21-8d5c2f7e6b14
status: experimental
description: Detects anomalous authorized-but-privilege-escalating request patterns against Adobe Experience Manager consistent with CWE-863 Incorrect Authorization abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75732
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - attack.privilege_escalation
  - cve.2026.75732
logsource:
  category: webserver
  product: aem
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'DELETE'
  selection_status:
    sc-status:
      - 200
      - 201
      - 202
  selection_paths:
    cs-uri-stem|contains:
      - '/bin/'
      - '/crx/'
      - '/content/'
      - '/system/console'
  filter_admin:
    cs-username|contains:
      - 'admin'
  condition: selection_method and selection_status and selection_paths and not filter_admin
falsepositives:
  - Legitimate low-privilege content editors performing permitted write operations.
level: high

YARA Rule

rule CVE_2026_75732_AEM_Authz_Bypass
{
    meta:
        description = "Detects exploit artifacts targeting Adobe Experience Manager Incorrect Authorization (CVE-2026-75732)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75732"
        date = "2026-01-01"
        cve = "CVE-2026-75732"
        severity = "critical"

    strings:
        $aem_path1 = "/content/dam/" ascii wide
        $aem_path2 = "/libs/granite/" ascii wide
        $aem_path3 = "/crx/de/" ascii wide
        $aem_path4 = "/bin/querybuilder" ascii wide
        $priv1 = "jcr:all" ascii
        $priv2 = "rep:write" ascii
        $priv3 = "jcr:readAccessControl" ascii
        $exec1 = "java.lang.Runtime" ascii
        $exec2 = "ProcessBuilder" ascii

    condition:
        (2 of ($aem_path*)) and (1 of ($priv*) or 1 of ($exec*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-75732 Adobe Experience Manager Incorrect Authorization Exploitation Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/content/"; http.uri; content:"/"; pcre:"/\/content\/[^\s]+\/(jcr:)?(rep:|jcr:)/Ui"; http.header; content:"Cookie"; http.header; content:"login-token"; classtype:attempted-admin; reference:cve,2026-75732; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-75732; sid:202675732; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=2m
  [ network where network.protocol == "http" and http.request.method in ("POST","PUT","DELETE") and url.path : ("/bin/*","/crx/*","/content/*") and http.response.status_code in (200,201,202) ]
  [ network where network.protocol == "http" and http.response.status_code in (200,201,202) and url.path : "/system/console/*" ]

Splunk SPL Query

index=web_logs sourcetype=aem:access
| eval is_low_priv=if(match(user, "(?i)^(anonymous|guest|author|contributor)$"), 1, 0)
| eval is_sensitive_path=if(match(uri_path, "(?i)^/(bin|crx|system/console|content/dam)"), 1, 0)
| where is_sensitive_path=1 AND is_low_priv=1 AND status IN (200, 201, 202)
| stats count, values(uri_path) AS paths, dc(uri_path) AS distinct_paths BY src_ip, user
| where distinct_paths >= 3 OR count >= 10
| sort - count

Wazuh OSSEC Rule

<group name="aem,web,attack,">
  <rule id="100732" level="12">
    <if_sid>31100</if_sid>
    <url>/bin/|/crx/|/system/console|/content/dam</url>
    <description>CVE-2026-75732: Possible AEM Incorrect Authorization exploitation from $(srcip) by user $(user)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_75732,privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, affected version range, or workaround has been published at the time of writing.

1. Immediate mitigations

   • Reduce exposure: ensure AEM author and administrative interfaces are not reachable from the public internet; place them behind a VPN, zero-trust proxy, or IP allowlist.
   • Audit and minimize the authenticated user population. Since PR:L is required, every provisioned low-privilege account is a potential initial condition for exploitation; disable unused, default, and service accounts, and enforce least privilege via the AEM Granite/JCR permission model.
   • Enforce strict ACL review: verify that no group or user holds unintended repository permissions and that sensitive paths (console, tooling, and admin endpoints) are protected for all non-administrative principals.
   • Instrument logging and alerting on authorization outcomes; monitor for authenticated low-privilege users reaching administrative or repository tooling paths (see Detection Guidance above).
   • Apply strict dispatcher/edge rules to deny requests to sensitive endpoints unless explicitly required.

2. Patch/upgrade steps

   • No patch exists. Continuously monitor the Adobe Security Bulletin (APSB) feed and the NVD entry for CVE-2026-75732 for an updated vendor release.
   • When Adobe publishes fixed versions, inventory all AEM deployments (author, publish, dispatcher, and any colocated components), stage the update in a non-production environment, test integrations, then roll out to production promptly.
   • Track AEM Service Pack and cumulative fix pack releases; AEM fixes are frequently distributed through Service Packs rather than standalone patches.

3. Long-term hardening

   • Enforce network segmentation so that AEM runtime hosts and the JCR repository are not directly reachable from untrusted networks, limiting the Scope Change impact.
   • Adopt defense in depth: WAF/edge authorization controls, runtime application self-protection, and host-level monitoring for unexpected process execution on AEM servers.
   • Maintain a continuous vulnerability management loop that treats AEM as a high-value asset, and rehearse incident response for authorization-bypass-to-code-execution scenarios.
   • Implement least privilege and strong authentication for all account types, and review authorization logic and test cases for incorrect-authorization (CWE-863) regressions as part of SDLC and change management.

References

• NVD — CVE-2026-75732: https://nvd.nist.gov/vuln/detail/CVE-2026-75732
• Adobe Security Bulletins and Advisories (APSB) — monitor for CVE-2026-75732 fix: https://helpx.adobe.com/security.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• CISA Known Exploited Vulnerabilities Catalog (status check — CVE not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or Nuclei template is available. No exploitation in the wild has been reported for CVE-2026-75732 at the time of writing, and no threat actor campaign has been publicly attributed.