CVE-2026-90532

Executive Summary

CVE-2026-90532 is an Incorrect Authorization (CWE-863) vulnerability in Adobe Experience Manager (AEM) that permits an unauthenticated, network-reachable attacker to execute arbitrary code in the context of the current user, with the potential to gain elevated access or control over a victim's account or session. Because the CVSS vector shows UI:N, S:C, and all CIA impacts rated High, the vulnerability is rated 10.0 (Critical) and requires no user interaction. No affected version ranges, patch, workaround, public proof-of-concept, or exploit code are available as of this report, and the CVE has not been scored by FIRST.org EPSS or added to CISA KEV.

Technical Analysis

The vulnerability class is Incorrect Authorization, mapped to CWE-863. The NVD description states that Adobe Experience Manager is affected by this issue and that successful exploitation "could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session." The description explicitly notes that exploitation "does not require user interaction" and that "Scope is changed."

From an authorization-model perspective, CWE-863 covers cases where an application fails to correctly verify that the requester holds the required privilege, role, or ownership for the requested action or resource. In an AEM deployment context—a Java-based content management and digital experience platform that exposes multiple HTTP-accessible entry points (author instances, publish instances, servlets, and content repository paths)—an authorization flaw means a request that should be rejected (or restricted to an authenticated/privileged user) is instead processed. Because AV:N and PR:N are specified, the vulnerable surface is network-reachable and exploitable without pre-existing credentials. The UI:N metric indicates the attack does not rely on a victim opening a file, clicking a link, or otherwise acting.

The stated outcome—arbitrary code execution in the context of the current user—means the flaw does not merely disclose content or allow unauthorized data modification; the authorization bypass can be leveraged to reach a code-execution primitive under the identity the service processes the request as. The Scope metric of S:C indicates the impact crosses a trust boundary: the vulnerable component's compromise can affect resources beyond its own security scope (for example, the host OS, adjacent services, or downstream sessions/accounts). The CNA title field and vendor/product attribution in the provided data are empty and marked "Unknown / Unknown," but the NVD description explicitly names Adobe Experience Manager as the affected product, so vendor attribution here follows the description rather than the empty metadata fields.

No specific vulnerable endpoints, servlet names, servlet paths, API routes, parameter names, class names, or code constructs are provided in the NVD description or CNA title. Consequently, this report does not invent them. The attack surface is therefore described at the vulnerability-class level: a network-reachable AEM entry point that performs authorization checks incorrectly for a request that can ultimately drive code execution. There is no public PoC and no Nuclei template, so the exact trigger sequence cannot be confirmed; the analysis below is inferred strictly from the vulnerability class and the supplied CVSS metrics. No public exploit-in-the-wild evidence, attack chains, or campaign attributions are provided in the data.

The EPSS score is "Not yet scored by FIRST.org," so no probability-of-exploitation estimate can be cited and none is fabricated here.

Exploitation Scenarios

The following chain is described at the vulnerability-class level because no endpoint, parameter, or method names are available from the NVD description or CNA title. No public PoC exists; the attack chain is inferred from the vulnerability class.

1. Reconnaissance / target identification. An unauthenticated attacker identifies an internet- or network-reachable Adobe Experience Manager instance. Typical fingerprinting examines HTTP responses and publicly exposed AEM content paths and product markers. The attacker needs no account on the target (PR:N) and needs no victim interaction (UI:N), so identification of a reachable AEM deployment is the primary precondition.

2. Triggering the incorrect authorization condition. The attacker sends a crafted request to a network-reachable AEM endpoint that is supposed to enforce an authorization decision (privilege, role, or ownership check) before permitting an action. Because the authorization check is implemented incorrectly (CWE-863), the request is accepted and processed when it should be denied. At no point does the attacker present valid privileged credentials—the flaw is the bypass itself.

3. Execution method at the vulnerability-class level. Having crossed the authorization boundary and reached functionality it should not access, the attacker leverages that access to obtain arbitrary code execution in the context of the user the service processes the request as. The description does not specify the exact execution mechanism (for example, which subsystem, template, or component executes attacker-influenced input), so no specific code pattern is asserted here. The description does state the result is arbitrary code execution, and the Scope:Changed metric indicates the compromise can extend beyond the initially reached component's boundary.

4. Post-exploitation impact. Per the description, the attacker may gain elevated access or control over the victim's account or session. Combined with arbitrary code execution in the current user's context, this supports further actions under that identity, lateral movement within the AEM deployment and connected systems, and manipulation of content, sessions, or accounts reachable from the compromised context. The S:C rating signals that effects are not confined to the vulnerable component alone.

Escalation realism: this scenario is consistent with the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) but remains unvalidated—no PoC, exploit code, or Nuclei template was observed, and no affected version range is published, so defenders cannot confirm exploitability against a specific build from the provided data alone.

Impact Assessment

• Confidentiality: High (C:H). Successful exploitation can expose data reachable under the context of the current user, including account or session material the attacker then controls.
• Integrity: High (I:H). Arbitrary code execution plus account/session control permits unauthorized modification of content, accounts, and system state.
• Availability: High (A:H). Code execution in the service context enables disruption of the affected AEM component and potentially dependent systems.
• Attack Vector: Network (AV:N). No local access is required.
• Attack Complexity: Low (AC:L). No specialized conditions are described.
• Privileges Required: None (PR:N). No prior authentication is needed.
• User Interaction: None (UI:N). No victim action is required, which raises the risk to unattended, internet-facing deployments.
• Scope: Changed (S:C). Impact crosses a trust boundary, so blast radius can exceed the directly vulnerable component.

Business impact: Adobe Experience Manager is commonly used for customer-facing digital experience, content, and asset delivery, so a 10.0 unauthenticated code-execution flaw can affect public web properties, brand trust, and downstream integrations. Because no affected version range is published, defenders cannot scope which deployments are at risk from the CVE data alone and must treat all network-exposed AEM instances as potentially affected until the vendor clarifies. There is no CISA KEV listing, no EPSS score, and no observed exploitation evidence in the provided data, so current real-world exploitation status is unknown.

Detection Guidance

Sigma Rule

title: Potential Adobe Experience Manager Incorrect Authorization Exploitation (CVE-2026-90532)
id: 9f2c1e7b-4a53-4d8e-b6f1-2026adobe90532
status: experimental
description: Detects anomalous HTTP requests to AEM endpoints followed by process activity indicative of unexpected code execution in the service context.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90532
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_aem:
    cs-uri-stem|contains:
      - '/content/'
      - '/crx/'
      - '/libs/'
      - '/system/console'
  filter_status:
    sc-status:
      - 200
      - 201
      - 202
  condition: selection_method and selection_aem and filter_status
falsepositives:
  - Legitimate authenticated administrative activity against AEM
  - Continuous integration or content-migration tooling
level: medium
tags:
  - attack.t1190
  - cwe.863

YARA Rule

rule CVE_2026_90532_AEM_Incorrect_Authorization
{
    meta:
        description = "Flags AEM-related artifacts potentially associated with Incorrect Authorization exploitation (CVE-2026-90532). Class-level heuristic only; no PoC reference available."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90532"
        cve = "CVE-2026-90532"
        date = "2026-01-01"
    strings:
        $aem1 = "Adobe Experience Manager" ascii wide
        $aem2 = "/content/dam/" ascii
        $aem3 = "/crx/" ascii
        $aem4 = "/system/console" ascii
    condition:
        uint16(0) == 0x4D5A or (any of ($aem*) and filesize < 20MB)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90532 - Adobe Experience Manager Incorrect Authorization Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/content/"; http.uri; content:"/crx/"; sid:202690532; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-90532, affected_product Adobe_Experience_Manager; classtype:attempted-admin; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-90532;)

Elastic Detection

sequence by source.ip with maxspan=2m
  [http where http.request.method in ("GET", "POST") and
     wildcard(http.request.uri, "/content/*") and
     http.response.status_code in (200, 201, 202)]
  [process where event.type == "start" and
     process.parent.name in ("java", "java.exe")]

Splunk SPL Query

index=web OR index=proxy
| eval aem_hit=if(match(uri, "(?i)/(content|crx|libs|system/console)"), 1, 0)
| where aem_hit=1 AND status IN (200, 201, 202)
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri) as uris by src_ip, status
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,adobe_aem,cve_2026_90532">
  <rule id="202690532" level="8">
    <if_sid>31100</if_sid>
    <match>/content/|/crx/|/system/console</match>
    <description>CVE-2026-90532: Possible Adobe Experience Manager Incorrect Authorization exploitation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_863,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version range is available in the provided data; the guidance below is generic hardening for the vulnerability class and must be validated against vendor advisories before implementation.

1. Immediate mitigations:

• Remove or restrict public network exposure of Adobe Experience Manager author and administrative interfaces; place AEM behind authenticated reverse proxies or VPN/zero-trust access where operationally feasible.
• Enforce strict authorization at the edge: deny-by-default policies for paths associated with administrative or authoring functionality, and log all access for later review.
• Apply rate limiting and WAF protections on all AEM content and administrative endpoints; deploy virtual patching rules that block anomalous unauthenticated requests to authoring and console paths.
• Monitor for unexpected process creation under the Java/AEM service account (bytecode or script interpreters spawned by the AEM process are a strong signal of code execution).

2. Patch / upgrade steps:

• Because no patch exists in the tracked sources, monitor Adobe's official security bulletin channel for the AEM security bulletin associated with this CVE and apply the referenced cumulative fix or hotfix as soon as it is published. No specific patch version reference exists in the provided data.
• Until a patch is available, treat the deployment as unpatched and maintain compensating controls listed above.

3. Long-term hardening:

• Re-baseline authorization logic across all exposed AEM entry points; ensure every privileged action performs server-side role/ownership verification, not client-side or obscurity-based checks.
• Adopt least privilege for the AEM service account and isolate the AEM host from unrelated production services to reduce scope-change impact.
• Enable comprehensive web-access and process-audit logging with forwarding to a central SIEM, and periodically test exposed AEM endpoints for authorization bypass with authenticated and unauthenticated test cases.

References

• NVD, CVE-2026-90532 — https://nvd.nist.gov/vuln/detail/CVE-2026-90532
• MITRE CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-90532 not listed as of this report) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Adobe Security Bulletins (monitor for the AEM advisory referencing CVE-2026-90532) — https://helpx.adobe.com/security/security-bulletin.html

No threat actor campaigns, exploit-in-the-wild evidence, or public proof-of-concept were identified in the provided data.