CVSS 9.6: Adobe AEM Critical Flaw CVE-2026-90531 Enables Silent Privilege Escalation

Adobe Experience Manager contains a critical security flaw that lets attackers with low-level accounts gain elevated access without needing users to click anything. This vulnerability, identified as CVE-2026-90531, poses a significant risk because it allows privilege escalation. Attackers can exploit this issue to access internal resources. The flaw exists in how the software processes XML data, allowing malicious entities to be interpreted by the system.

The risk

According to the National Vulnerability Database, CVE-2026-90531 carries a CVSS score of 9.6, which classifies it as Critical. The vulnerability stems from an Improper Restriction of XML External Entity Reference, commonly known as XXE. This weakness allows a low-privileged attacker to escalate their permissions and gain elevated access to internal resources. Crucially, the exploitation of this issue does not require any user interaction, meaning the attack can proceed silently in the background.

Who is exposed

The vulnerability affects several versions of Adobe Experience Manager. Users of Adobe Experience Manager as a Cloud Service are exposed if they are running versions up to 2026.9.28187. Additionally, Adobe Experience Manager 6.5 LTS users are affected if they are on versions up to 6.5 LTS SP3. Those using Adobe Experience Manager 6.5 are also at risk if their version is up to 6.5.25. Organizations using any of these specific version ranges are currently vulnerable to this privilege escalation attack.

Cost and compliance

The source material does not provide specific details regarding financial costs, regulatory fines, or compliance impacts associated with CVE-2026-90531. No information is available about data breach notifications or legal liabilities resulting from this specific vulnerability. Compliance frameworks such as HIPAA or GDPR are not mentioned in the context of this flaw. Therefore, no statements can be made about the direct compliance consequences based on the provided records.

What should you do?

Check your current Adobe Experience Manager version against the affected lists immediately. If you are running a vulnerable version, prioritize patching or mitigating the risk. Monitor server logs for unusual XML processing activity or unexpected privilege changes. Ensure that all administrative accounts have strong, unique credentials to limit the impact of any potential escalation.

The background in plain language

XML External Entity flaws occur when software trusts external data definitions too much. Attackers can inject malicious instructions into XML files, tricking the system into reading sensitive files or making unauthorized requests. Privilege escalation means an attacker starts with minimal access but gains higher-level permissions. This allows them to bypass security controls meant to restrict low-level users. Teams usually validate all incoming data strictly to prevent such injections from succeeding.

What to do and how to stay safe: Adobe Experience Manager

• Inventory all Adobe Experience Manager instances to identify versions matching the affected ranges.
• Implement strict input validation for XML data to reject external entity references.
• Monitor network traffic for unusual outbound connections from AEM servers.
• Review access logs for accounts that recently gained elevated permissions unexpectedly.

Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-90531?

The CVSS score for CVE-2026-90531 is 9.6, which is rated as Critical.

Does exploiting this vulnerability require user interaction?

No, exploitation of this issue does not require user interaction.

Which Adobe Experience Manager versions are affected?

AEM as a Cloud Service up to 2026.9.28187, AEM 6.5 LTS up to SP3, and AEM 6.5 up to 6.5.25 are affected.