Adobe Experience Manager Server-Side Request Forgery Vulnerability Allowing Arbitrary Code Execution

A Server-Side Request Forgery (SSRF) vulnerability has been identified in Adobe Experience Manager (AEM) that could lead to arbitrary code execution in the context of the current user. This vulnerability affects AEM Cloud Service (CS) Release 2026.5.0 and earlier, as well as AEM 6.5 LTS Service Pack 1 and earlier and AEM 6.5 Service Pack 24 and earlier. A low-privileged attacker could exploit this vulnerability to make unauthorized server-side requests, potentially gaining elevated access or control over the victim's account or session. The exploitation of this vulnerability does not require user interaction.

Impact

Exploitation of this vulnerability could result in arbitrary code execution on the server, potentially allowing an attacker to execute malicious code in the context of the affected user.

Remediation

Users are advised to update to Adobe Experience Manager AEM Cloud Service (CS) Release 2026.6.0, AEM 6.5 LTS Service Pack 2 - Hotfix for NPR-43972, or AEM 6.5 Service Pack 25 - Hotfix for NPR-43971.