CVE-2026-19232— Adobe Experience Manager | Incorrect Authorization (CWE-863)
Quick assessment
Affected
Adobe Adobe Experience Manager as a Cloud Service
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Adobe Experience Manager 存在一个“不正确的授权（Incorrect Authorization）”漏洞，该漏洞可能导致在当前用户上下文中执行任意代码，从而可能获得对受害者账户或会话的更高权限访问或控制权。低权限攻击者可利用此漏洞，以提升其访问权限或控制受害者的账户或会话。利用该漏洞无需用户交互。此外，漏洞的影响范围（Scope）已发生变更。
Possible ATT&CK Techniques 3 AI
T1078 · Valid Accounts T1190 · Exploit Public-Facing Application T1089
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-19232
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Adobe Experience Manager | Incorrect Authorization (CWE-863)
Source: CVE Program / CVE List V5
Vulnerability Description
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. A low-privileged attacker could exploit this vulnerability to gain elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Adobe | Adobe Experience Manager as a Cloud Service | 0 ~ 2026.7.0 | - |
|
| Adobe | Adobe Experience Manager 6.5 LTS | 0 ~ SP2 | - |
|
| Adobe | Adobe Experience Manager 6.5 | 0 ~ 6.5.24 | - |
|
II. Public POCs for CVE-2026-19232
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19232
请登录查看更多情报信息。
Same Patch Batch · Adobe · 2026-09-08 · 167 CVEs total
| CVE-2026-82004 | 10.0 CRITICAL | Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS C |
| CVE-2026-48273 | 9.9 CRITICAL | ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval In |
| CVE-2026-76201 | 9.3 CRITICAL | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) |
| CVE-2026-76200 | 9.3 CRITICAL | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) |
| CVE-2026-75746 | 9.1 CRITICAL | ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje |
| CVE-2026-81996 | 8.8 HIGH | Acrobat Reader | Incorrect Authorization (CWE-863) |
| CVE-2026-77111 | 8.7 HIGH | Adobe Commerce | Incorrect Authorization (CWE-863) |
| CVE-2026-77774 | 8.6 HIGH | Adobe Commerce | Incorrect Authorization (CWE-863) |
| CVE-2026-77109 | 8.6 HIGH | Adobe Commerce | Incorrect Authorization (CWE-863) |
| CVE-2026-75990 | 8.6 HIGH | Illustrator | Incorrect Authorization (CWE-863) |
| CVE-2026-75991 | 8.6 HIGH | Illustrator | Improper Input Validation (CWE-20) |
| CVE-2026-76190 | 8.6 HIGH | ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval In |
| CVE-2026-76199 | 8.6 HIGH | Photoshop Desktop | Uncontrolled Search Path Element (CWE-427) |
| CVE-2026-75993 | 8.5 HIGH | ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) |
| CVE-2026-75999 | 8.4 HIGH | ColdFusion | Improper Input Validation (CWE-20) |
| CVE-2026-76191 | 8.2 HIGH | Animate | Improper Control of Generation of Code ('Code Injection') (CWE-94) |
| CVE-2026-81994 | 8.2 HIGH | Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Proto |
| CVE-2026-76202 | 8.2 HIGH | Adobe Commerce | Incorrect Authorization (CWE-863) |
| CVE-2026-81983 | 7.8 HIGH | Acrobat Reader | Out-of-bounds Write (CWE-787) |
| CVE-2026-79908 | 7.8 HIGH | Acrobat Reader | Out-of-bounds Write (CWE-787) |
Showing top 20 of 167 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Adobe Experience Manager as a Cloud Service
-
CVE-2026-71357
Adobe Experience Manager | Cross-site Scripting (DOM-based X -
CVE-2026-75678
Adobe Experience Manager | Cross-site Scripting (DOM-based X -
CVE-2026-71565
Adobe Experience Manager | Cross-site Scripting (DOM-based X -
CVE-2026-75687
Adobe Experience Manager | Cross-site Scripting (DOM-based X -
CVE-2026-75672
Adobe Experience Manager | Cross-site Scripting (DOM-based X
Same vendor: Adobe
Same weakness: CWE-863
-
CVE-2026-14892
Tanium addressed an improper access controls vulnerability i -
CVE-2026-87046
Tanium addressed an improper access controls vulnerability i -
CVE-2026-87075
Tanium addressed an improper access controls vulnerability i -
CVE-2026-87544
Chrome 153前扩展程序授权错误，低危 -
CVE-2026-87575
Chrome 153.0.8010.36 前 Loader 授权错误
V. Comments for CVE-2026-19232
No comments yet