CVE-2026-90531: fallo crítico en Adobe Experience Manager 6.5
Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
Publicada el · Actualizada el
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.6epss 1.4%
probabilidad de explotación
1.4%top 28% de las CVE
explotación observada
noninguna fuente lo reporta
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Productos afectados
Adobe · Adobe Experience Manager 6.5Adobe · Adobe Experience Manager 6.5 LTSAdobe · Adobe Experience Manager as a Cloud ServiceCVEs relacionadas — Adobe Experience Manager 6.5
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-103848CRITICALAdobe Experience Manager | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 1.4%CVE-2026-48310HIGHAdobe Experience Manager | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 1.0%CVE-2026-83662CRITICALAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 1.0%CVE-2026-19232CRITICALAdobe Experience Manager | Incorrect Authorization (CWE-863)EPSS 1.0%CVE-2026-48359CRITICALAdobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 1.0%CVE-2026-48383CRITICALAdobe Experience Manager | Incorrect Authorization (CWE-863)EPSS 1.0%