# CVE-2026-48382: Adobe Experience Manager authorization bypass with code execution

Source: https://junglewise.ai/threats/cve-2026-48382-adobe-experience-manager-is-affected-by-an-incorrect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-48382 · Severity: critical · CVSS 10 · Published 2026-10-13

Adobe Experience Manager is a content management and digital experience platform used by organizations to manage web content and customer interactions. An authorization flaw allows attackers to execute arbitrary code in the context of authenticated users without requiring user interaction, potentially leading to account compromise or elevated system control. The vulnerability has a critical severity rating with a CVSS score of 10.0.

Technologies: [Adobe Experience Manager](https://junglewise.ai/threats/technologies/adobe-experience-manager). Vendors: [Adobe](https://junglewise.ai/threats/vendors/adobe).

## Quick answers

**Is CVE-2026-48382 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48382 being exploited in the wild.

**How severe is CVE-2026-48382?** Critical severity, with a CVSS score of 10, published 13 October 2026.

**Which products and versions are affected?** Adobe Experience Manager.

**Is there a fix for CVE-2026-48382?** Yes: fixed in <UNKNOWN>. Until then: <UNKNOWN> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48382 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-48382?** Check whether you run Adobe Experience Manager. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in <UNKNOWN>

<UNKNOWN>

## Technical details

An incorrect authorization vulnerability in Adobe Experience Manager fails to properly validate access controls, allowing attackers to execute arbitrary code in the context of the current user. The vulnerability requires network access but does not require user interaction for exploitation. The flaw impacts the scope of the affected system, potentially enabling privilege escalation and unauthorized control over victim accounts or sessions.

## Affected products

- Adobe Experience Manager

## Timeline

- 2026-10-13: disclosed

## References

- [https://helpx.adobe.com/security/products/experience-manager/apsb26-152.html](https://helpx.adobe.com/security/products/experience-manager/apsb26-152.html)

## Related threats

- [Adobe Experience Manager incorrect authorization leading to code execution](https://junglewise.ai/threats/cve-2026-90532-adobe-experience-manager-is-affected-by-an-incorrect)
- [Adobe Experience Manager XXE privilege escalation](https://junglewise.ai/threats/cve-2026-90531-adobe-experience-manager-is-affected-by-an-improper-restriction)
- [Adobe Experience Manager DOM-based XSS vulnerability](https://junglewise.ai/threats/cve-2026-83960-adobe-experience-manager-is-affected-by-a-dom-based-cross-site)
- [Adobe Experience Manager DOM-based cross-site scripting](https://junglewise.ai/threats/cve-2026-83958-adobe-experience-manager-is-affected-by-a-dom-based-cross-site)
- [Adobe Experience Manager reflected XSS vulnerability](https://junglewise.ai/threats/cve-2026-83662-adobe-experience-manager-is-affected-by-a-reflected-cross-site)