CVE-2026-48259 — Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)

Description (CNA)

Adobe Experience Manager is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could leverage this vulnerability to issue unauthorized server-side requests, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

Affected (CNA)

Vendor / product	Versions
Adobe / Adobe Experience Manager as a Cloud Service	affected 0 through 2026.5.0; unaffected 2026.6.0
Adobe / Adobe Experience Manager 6.5 LTS	affected 0 through SP2; unaffected SP2 - Hotfix for NPR-43972
Adobe / Adobe Experience Manager 6.5	affected 0 through 6.5.25; unaffected 6.5.25 - Hotfix for NPR-43971

CWE

CWE-918

References

https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.