Adobe Experience Manager: Four Critical CVEs in APSB26-189
This text was generated using artificial intelligence (AI).Adobe has released the Security Advisory APSB26-189 in total 14 vulnerabilities addressed in Adobe Experience Manager. Four documented critical entries have a CVSS score of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): CVE-2026-119017, CVE-2026-113580, CVE-2026-114371 and CVE-2026-113579. Adobe rates the advisory with Deployment Priority 2 . No active exploitation of the addressed vulnerabilities has been documented.
Vulnerability: CVE-2026-119017 (CVSS 9.9, critical); others: CVE-2026-113580, CVE-2026-114371 among others.
Status: No active abuse has been documented
Affected AEM Deployment Forms
The critical CVEs affect different deployment forms of Adobe Experience Manager:
CVE-2026-119017 affects AEM 6.5.
CVE-2026-113580 affects AEM as a Cloud Service.
CVE-2026-113579 affects AEM as a Cloud Service.
CVE-2026-114371 affects AEM as a Cloud Service, AEM 6.5, and AEM 6.5 LTS – all three deployment forms are affected.
For the assessment, it is crucial to know which AEM deployment form an organization actually uses.
Technical Classification of the Critical CVEs
CVE-2026-119017 and CVE-2026-114371 are classified as Incorrect Authorization described. CVE-2026-113580 and CVE-2026-113579 involve insufficient control during code generation, classified as Code Injection classified.
For all four critical CVEs, Adobe documents a network attack with low attack requirements. An attacker with limited permissions could execute arbitrary code in the context of the current user. User interaction is not required.
The impacts affect confidentiality, integrity, and availability. The documented scope may extend beyond the original security boundary.
Prioritization of Patch Status and Exposure
The first review should clarify which AEM deployment form is in use – AEM 6.5, AEM 6.5 LTS, or AEM as a Cloud Service – and which instances are publicly accessible. The respective CVE assignment can then be incorporated into patch planning.
For AEM as a Cloud Service, Adobe mentions a maintenance release to address CVE-2026-113580 and CVE-2026-113579. CVE-2026-114371 also affects AEM as a Cloud Service (up to and including 2026.10.29023), AEM 6.5 (up to and including 6.5.25), and AEM 6.5 LTS and therefore needs to be treated across deployment forms. For AEM 6.5 and AEM 6.5 LTS, the provided information refers to Adobe hotfixes or service pack statuses for CVE-2026-119017 and CVE-2026-114371.
A robust treatment includes, in particular:
Capture AEM instances and their deployment form.
Check the patch status for the four critical CVEs.
Assign Cloud instances CVE-2026-113580, CVE-2026-113579, and CVE-2026-114371.
Assign AEM 6.5 and AEM 6.5 LTS instances CVE-2026-119017 and CVE-2026-114371.
Incorporate Adobe notes on hotfixes, service packs, and maintenance releases into the change process.
Check the complete list of the 14 CVEs addressed in APSB26-189 in the Adobe Advisory.
Relevance for publicly accessible AEM instances
Adobe Experience Manager can be provided under corporate domains. This makes the inventory of externally accessible AEM instances relevant for processing the advisory. The product name in an internal software list is not sufficient if it remains unclear which instances are accessible and which deployment form they use.
Prioritization connects three questions: Where is AEM running, which variant is in use, and which manufacturer update path applies to the instance? This assignment reduces the risk that critical notes are only treated at the product level, even though individual systems have different update requirements.
For organizations in Germany and Austria that fall under NIS-2 or the Austrian NISG, a successfully exploited advisory of this criticality may trigger a reporting obligation to the relevant authority. Swiss organizations check their reporting obligations under the revised Information Security Act (ISG) with the BACS. Regardless of the regulatory framework, it applies: If personal data of EU citizens are compromised during an exploitation, the 72-hour reporting deadline under Art. 33 GDPR applies.
Visibility for EASM and Cyber Vendor Risk Management
LocateRisk supports visibility of publicly accessible systems and deployed software under its corporate domains in External Attack Surface Management. For Adobe Experience Manager, this visibility can assist in the inventory of AEM instances for the assessment of APSB26-189 – including forgotten subdomains or untracked cloud assets that are not captured in internal software lists.
The platform can make visible the deployed software and its public accessibility. The specific vulnerability of an individual instance still requires checking deployment form, patch status, and Adobe notes.
In Cyber Vendor Risk Management, the publication of a critical Adobe advisory can be recorded as a security-relevant event with a technology provider. For operational processing, assigning to one's own AEM instances, responsibilities, and update processes remains necessary.
Am I affected?
This affects Adobe Experience Manager in the versions mentioned above. Those who want to know whether Adobe Experience Manager is visible in their externally accessible infrastructure can use the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
APSB26-189 affects AEM as a Cloud Service, AEM 6.5, and AEM 6.5 LTS. CVE-2026-114371 is relevant across all deployment forms; CVE-2026-119017 only affects AEM 6.5, while CVE-2026-113580 and CVE-2026-113579 only affect AEM as a Cloud Service.
All four critical CVEs have a CVSS score of 9.9 (Critical). The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H describes a network-based attack with low complexity and privilege requirements without user interaction, which can fully compromise confidentiality, integrity, and availability and extend the scope beyond the original security boundary.
At the time of the advisory's publication on November 10, 2026, Adobe does not document any active exploitation of the affected vulnerabilities. Adobe classifies the advisory with Deployment Priority 2, which requires a timely but not immediate emergency response.
As of November 11, 2026. This contribution is for general informational purposes only and does not constitute legal, security, or action advice in individual cases. IT security situation and patch availability may have changed since the publication; the linked manufacturer advisory is always authoritative. Despite careful research, we do not guarantee the timeliness, accuracy, or completeness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
Initial assessment in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-119017
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français