Adobe Experience Manager XML Injection Vulnerability Leading to Security Feature Bypass

An XML injection vulnerability has been identified in Adobe Experience Manager (AEM) versions 6.5.23.0 and earlier. This vulnerability allows a low-privileged attacker to manipulate XML queries, potentially leading to unauthorized write access and bypassing security features.

Impact

Exploitation of this vulnerability could result in a security feature bypass, allowing for unauthorized manipulation of XML queries and limited write access.

Remediation

Users are advised to update to Adobe Experience Manager 6.5.23 (Granite-61551 Hotfix) or AEM Cloud Service Release 2025.9. For assistance with AEM versions 6.4, 6.3, and 6.2, please contact Adobe customer care.