Adobe Experience Manager Improper Restriction of XML External Entity Reference Vulnerability Allowing Arbitrary Code Execution

A vulnerability allowing improper restriction of XML external entity references (XXE) has been identified in Adobe Experience Manager (AEM). This vulnerability could lead to arbitrary code execution in the context of the current user. It affects AEM Cloud Service (CS) releases through 2026.5.0, as well as AEM 6.5 LTS Service Pack 1 and earlier, and AEM 6.5 Service Pack 24 and earlier. A low-privileged attacker could exploit this vulnerability to read sensitive files, potentially gaining elevated access or control over the victim's account or session. Notably, exploitation does not require user interaction.

Impact

Successful exploitation allows arbitrary code execution in the context of the current user.

Remediation

Users are advised to update to Adobe Experience Manager AEM Cloud Service (CS) Release 2026.6.0, AEM 6.5 LTS Service Pack 2 - Hotfix for NPR-43972, or AEM 6.5 Service Pack 25 - Hotfix for NPR-43971.