CVE-2026-48289— Adobe Experience Manager | Improper Input Validation (CWE-20)
Possible ATT&CK Techniques 3AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Adobe | Adobe Experience Manager | ≤ 2026.04 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-48289
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Adobe Experience Manager | Improper Input Validation (CWE-20)
Source: NVD (National Vulnerability Database)
Vulnerability Description
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
输入验证不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Adobe Experience Manager 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Adobe Experience Manager是美国奥多比（Adobe）公司的一套可用于构建网站、移动应用程序和表单的内容管理解决方案。该方案支持移动内容管理、营销销售活动管理和多站点管理等。 Adobe Experience Manager 6.5.24版本、LTS SP1版本和2026.04及之前版本存在输入验证错误漏洞，该漏洞源于输入验证不当，可能导致安全功能绕过，进而获得未授权写入权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Adobe | Adobe Experience Manager | 0 ~ 2026.04 | - |
II. Public POCs for CVE-2026-48289
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-48289
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-48289 (1)
Same Patch Batch · Adobe · 2026-06-09 · 123 CVEs total
| CVE-2026-48303 | 10.0 CRITICAL | Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) |
| CVE-2026-47938 | 10.0 CRITICAL | Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918) |
| CVE-2026-47928 | 9.6 CRITICAL | ColdFusion | Improper Input Validation (CWE-20) |
| CVE-2026-34691 | 9.3 CRITICAL | Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79) |
| CVE-2026-47932 | 8.8 HIGH | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' |
| CVE-2026-47907 | 8.6 HIGH | Dreamweaver Desktop | Improper Access Control (CWE-284) |
| CVE-2026-47906 | 8.6 HIGH | Dreamweaver Desktop | Dependency on Vulnerable Third-Party Component (CWE-1395) |
| CVE-2026-47931 | 8.4 HIGH | ColdFusion | Improper Input Validation (CWE-20) |
| CVE-2026-47929 | 8.4 HIGH | ColdFusion | Incorrect Authorization (CWE-863) |
| CVE-2026-47930 | 8.1 HIGH | ColdFusion | Improper Input Validation (CWE-20) |
| CVE-2026-34693 | 8.0 HIGH | Adobe Experience Manager Forms JEE | Cross-site Scripting (Reflected XSS) (CWE-79) |
| CVE-2026-34707 | 7.8 HIGH | InCopy | Heap-based Buffer Overflow (CWE-122) |
| CVE-2026-47919 | 7.8 HIGH | Acrobat Reader | Use After Free (CWE-416) |
| CVE-2026-34708 | 7.8 HIGH | InCopy | Stack-based Buffer Overflow (CWE-121) |
| CVE-2026-47921 | 7.8 HIGH | Acrobat Reader | Use After Free (CWE-416) |
| CVE-2026-47920 | 7.8 HIGH | Acrobat Reader | Use After Free (CWE-416) |
| CVE-2026-34706 | 7.8 HIGH | InCopy | Out-of-bounds Write (CWE-787) |
| CVE-2026-47913 | 7.8 HIGH | Acrobat Reader | Use After Free (CWE-416) |
| CVE-2026-47914 | 7.8 HIGH | Acrobat Reader | Use After Free (CWE-416) |
| CVE-2026-34710 | 7.8 HIGH | Substance3D - Sampler | Out-of-bounds Write (CWE-787) |
Showing top 20 of 123 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Adobe Experience Manager
- CVE-2026-47980
Adobe Experience Manager | Cross-site Scripting (Stored XSS) - CVE-2026-47945
Adobe Experience Manager | Cross-site Scripting (Stored XSS) - CVE-2026-48280
Adobe Experience Manager | Cross-site Scripting (DOM-based X - CVE-2026-47985
Adobe Experience Manager | Cross-site Scripting (DOM-based X - CVE-2026-47935
Adobe Experience Manager | Cross-site Scripting (DOM-based X
Same weakness: CWE-20
- CVE-2026-13434
Virt-controller-rhel9: kubevirt: kubevirt: multus default-ne - CVE-2026-52801
Gogs: Ability to import local repositories via Mirror Settin - CVE-2025-64719
Gogs: Denial of Service in repository/wiki file listing web - CVE-2026-13024
Chrome <149.0.7827.197 导航输入验证不足致站点隔离绕过 - CVE-2026-13025
Chrome<149.0.7827.197 DevTools竞态条件致沙箱逃逸
V. Comments for CVE-2026-48289
No comments yet