Adobe Experience Manager (AEM) XXE Privilege Escalation
CVE-2026-90531 Published on October 13, 2026
Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
Vulnerability Analysis
CVE-2026-90531 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is a XXE Vulnerability?
The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVE-2026-90531 has been classified to as a XXE vulnerability or weakness.
Products Associated with CVE-2026-90531
Want to know whenever a new CVE is published for Adobe Experience Manager? stack.watch will email you.
Affected Versions
Adobe Experience Manager as a Cloud Service:- Before and including 2026.9.28187 is affected.
- Version 2026.9.28386 is unaffected.
- Before and including 6.5 LTS SP3 is affected.
- Version 6.5 LTS SP1 - Hotfix for GRANITE-71772, 6.5 LTS SP2 - Hotfix for GRANITE-71772, 6.5 LTS SP3 - Hotfix for GRANITE-71772 is unaffected.
- Before and including 6.5.25 is affected.
- Version 6.5.22 - Hotfix for GRANITE-71772, 6.5.23 - Hotfix for GRANITE-71772, 6.5.24 - Hotfix for GRANITE-71772, 6.5.25 - Hotfix for GRANITE-71772 is unaffected.