CVE Explorer
CVE-2026-48289
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"affected","product":"Adobe Experience Manager","vendor":"Adobe","versions":[{"lessThanOrEqual":"2026.04","status":"affected","version":"0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:4bf33d6ab8153b1bc87c2766401639e0ba541c536ff34ef15eabc6412224c36a · sha256:7debeb6a4539409d… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","availabilityRequirement":"NOT_DEFINED","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","confidentialityRequirement":"NOT_DEFINED","environmentalScore":3.5,"environmentalSeverity":"LOW","exploitCodeMaturity":"NOT_DEFINED","integrityImpact":"LOW","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"LOW","modifiedAttackVector":"NETWORK","modifiedAvailabilityImpact":"NONE","modifiedConfidentialityImpact":"NONE","modifiedIntegrityImpact":"LOW","modifiedPrivilegesRequired":"LOW",…
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:4bf33d6ab8153b1bc87c2766401639e0ba541c536ff34ef15eabc6412224c36a · sha256:7debeb6a4539409d… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-20","description":"Improper Input Validation (CWE-20)","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:4bf33d6ab8153b1bc87c2766401639e0ba541c536ff34ef15eabc6412224c36a · sha256:7debeb6a4539409d… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"tags":["vendor-advisory"],"url":"https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:4bf33d6ab8153b1bc87c2766401639e0ba541c536ff34ef15eabc6412224c36a · sha256:7debeb6a4539409d… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.