Adobe Experience Manager Missing Authentication Vulnerability Allowing Security Feature Bypass

A vulnerability in Adobe Experience Manager (AEM) related to missing authentication for critical functions could lead to a security feature bypass. This issue allows unauthorized write access. The vulnerability is present in AEM Cloud Service (CS) Release 2026.5.0 and earlier, as well as in AEM 6.5 LTS Service Pack 1 and earlier and AEM 6.5 Service Pack 24 and earlier. Exploitation of this vulnerability does not require user interaction.

Impact

Exploitation of this vulnerability could result in unauthorized write access, allowing attackers to bypass security measures and potentially manipulate data or application behavior.

Remediation

Users are advised to update to Adobe Experience Manager AEM Cloud Service (CS) Release 2026.6.0, AEM 6.5 LTS Service Pack 2 - Hotfix for NPR-43972, or AEM 6.5 Service Pack 25 - Hotfix for NPR-43971.