CVE-2026-105895— Adobe Experience Manager | Improper Input Validation (CWE-20)
Quick assessment
Affected
Adobe Adobe Experience Manager 6.5
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Adobe Experience Manager 存在一个输入验证不当漏洞，可能导致在当前用户上下文环境中执行任意代码，从而可能获得更高的访问权限或控制受害者账户或会话。利用此漏洞无需用户交互。影响范围已调整。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1203 · Exploitation for Client ExecutionAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Adobe | Adobe Experience Manager 6.5 | ≤ 6.5.25 |
affected |
6.5.23 - Hotfix for CQ-4364862, 6.5.24 - Hotfix for CQ-4364862, 6.5.25 - Hotfix for CQ-4364862 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105895
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Adobe Experience Manager | Improper Input Validation (CWE-20)
Source: CVE Program / CVE List V5
Vulnerability Description
Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Adobe | Adobe Experience Manager 6.5 | 0 ~ 6.5.25 | - |
|
II. Public POCs for CVE-2026-105895
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105895
请登录查看更多情报信息。
Other References for CVE-2026-105895 (1)
-
404 vendor-advisory
Same Patch Batch · Adobe · 2026-10-13 · 177 CVEs total
| CVE-2026-103849 | 10.0 CRITICAL | Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CW |
| CVE-2026-106622 | 10.0 CRITICAL | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) |
| CVE-2026-106624 | 10.0 CRITICAL | ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) |
| CVE-2026-48382 | 10.0 CRITICAL | Adobe Experience Manager | Incorrect Authorization (CWE-863) |
| CVE-2026-48383 | 10.0 CRITICAL | Adobe Experience Manager | Incorrect Authorization (CWE-863) |
| CVE-2026-105899 | 10.0 CRITICAL | ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) |
| CVE-2026-90532 | 10.0 CRITICAL | Adobe Experience Manager | Incorrect Authorization (CWE-863) |
| CVE-2026-105903 | 9.9 CRITICAL | ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) |
| CVE-2026-103848 | 9.9 CRITICAL | Adobe Experience Manager | Improper Neutralization of Special Elements used in an OS Comma |
| CVE-2026-106612 | 9.9 CRITICAL | ColdFusion | Incorrect Authorization (CWE-863) |
| CVE-2026-75732 | 9.9 CRITICAL | Adobe Experience Manager | Incorrect Authorization (CWE-863) |
| CVE-2026-92909 | 9.8 CRITICAL | Adobe Commerce | Incorrect Authorization (CWE-863) |
| CVE-2026-75994 | 9.6 CRITICAL | ColdFusion | Incorrect Authorization (CWE-863) |
| CVE-2026-106620 | 9.6 CRITICAL | ColdFusion | Incorrect Authorization (CWE-863) |
| CVE-2026-90531 | 9.6 CRITICAL | Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') ( |
| CVE-2026-100133 | 9.3 CRITICAL | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) |
| CVE-2026-90530 | 9.3 CRITICAL | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' |
| CVE-2026-106629 | 9.3 CRITICAL | Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) |
| CVE-2026-106630 | 9.3 CRITICAL | Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) |
| CVE-2026-83662 | 9.3 CRITICAL | Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) |
Showing top 20 of 177 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Adobe Experience Manager 6.5
-
CVE-2026-48398
Adobe Experience Manager | Cross-site Scripting (DOM-based X -
CVE-2026-110084
Adobe Experience Manager | XML Injection (aka Blind XPath In -
CVE-2026-110083
Adobe Experience Manager | Improper Neutralization of Specia -
CVE-2026-110080
Adobe Experience Manager | Cross-site Scripting (DOM-based X -
CVE-2026-110079
Adobe Experience Manager | Cross-site Scripting (DOM-based X
Same vendor: Adobe
-
CVE-2026-100119
CAI Content Credentials | Improper Input Validation (CWE-20) -
CVE-2026-102501
CAI Content Credentials | Improper Input Validation (CWE-20) -
CVE-2026-100114
CAI Content Credentials | Improper Access Control (CWE-284) -
CVE-2026-100136
CAI Content Credentials | Integer Overflow or Wraparound (CW -
CVE-2026-103294
CAI Content Credentials | Improper Certificate Validation (C
Same weakness: CWE-20
-
CVE-2026-79837
HPE NonStop SQL/MX UDR SERVER - Service disruption vulnerabi -
CVE-2026-79836
HPE NonStop SQL/MX Run-Time Statistics - Information disclo -
CVE-2026-79835
HPE Nonstop KMS Server - Buffer overflow vulnerability -
CVE-2026-79834
HPE NonStop SQL/MX SQLCAT - Unauthorized command execution v -
CVE-2026-79829
HPE NonStop HTTP WEBSERVER - Memory corruption vulnerability
V. Comments for CVE-2026-105895
No comments yet