CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Adobe Experience Manager incorrect authorization to arbitrary code execution (CVSS 10.0, no privileges), APSB26-152

cve · CVE-2026-48382 single-source

Coverage
1
first 2026-10-14 → last 2026-10-14
Latest activity
2026-10-14
Adobe fixes unauthenticated CVSS 10.0 flaws in ColdFusion, Experience Manager and Commerce; no exploitation…
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
3
1 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-48382, newest first. Check the date before acting on an older one.

  • Update every internet-facing ColdFusion server to 2025.0.14 or 2023.0.26, every AEM instance to Cloud Service 2026.9.28386 or the per-issue hotfixes for 6.5 Service Pack 25 and 6.5 LTS Service Pack 3, and Adobe Commerce and Magento Open Source to the 2026-oct build of the installed 2.4.x line (together with the CVE-2026-75650 hotfix from the September APSB26-146 update where it is missing); Magento Open Source 2.4.6 has no listed fix.
    2026-10-14CVE-2026-105899 +9

Defender insights

What each entry about CVE-2026-48382 tells a defender to do, newest first.

2026-10-14NOTABLEAdobe fixes unauthenticated CVSS 10.0 flaws in ColdFusion, Experience Manager and Commerce; no exploitation known

Exposure · detection

Story timeline

  1. 2026-10-14Adobe October 2026 bulletins: unauthenticated CVSS 9.0 to 10.0 flaws, most leading to code execution, in ColdFusion (APSB26-144), Experience Manager (APSB26-152) and Commerce and Magento (APSB26-153), none reported exploited
    trending-vulnerabilitiesAdobe fixes unauthenticated CVSS 10.0 flaws in ColdFusion, Experience Manager and Commerce; no exploitation known

Hunting pivots

Affected products
Adobe ColdFusionAdobe CommerceAdobe Experience ManagerMagento Open Source
Tags
patch-availablepre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-14/adobe-october-2026-coldfusion-aem-commerce-unauth-critical · ATT&CK page ↗

Entries about Adobe Experience Manager incorrect authorization to arbitrary code execution (CVSS 10.0, no privileges), APSB26-152 (1)

2026-10-14 · view entry permalink →

NOTABLECVE-2026-105899 +9NATOA2

Adobe October 2026 bulletins: unauthenticated CVSS 9.0 to 10.0 flaws, most leading to code execution, in ColdFusion (APSB26-144), Experience Manager (APSB26-152) and Commerce and Magento (APSB26-153), none reported exploited

Adobe's 2026-10-13 bulletins put critical fixes into three server products: ColdFusion, Experience Manager and Commerce. Adobe says it is not aware of any exploits in the wild for the ColdFusion issues (Adobe ColdFusion APSB26-144, 2026-10-13). ColdFusion 2025 up to 2025.0.13 and 2023 up to 2023.0.25 are affected and 2025.0.14 and 2023.0.26 fix them; the bulletin lists five network flaws that need no privileges at CVSS 9.0 or above: an unrestricted file upload leading to arbitrary code execution (CVE-2026-105899, 10.0), a server-side request forgery rated privilege escalation (CVE-2026-106622, 10.0), an input-validation flaw leading to code execution (CVE-2026-106624, 9.8), a code injection rated privilege escalation (CVE-2026-106621, 9.1) and a further input-validation code-execution flaw (CVE-2026-106619, 9.0, high complexity), besides code-execution flaws that need a low-privileged account at 9.9 (Adobe ColdFusion APSB26-144, 2026-10-13).

Experience Manager APSB26-152 covers Cloud Service 2026.9.28187 and earlier, 6.5 up to Service Pack 25 and 6.5 LTS up to Service Pack 3: three incorrect-authorization flaws that lead to arbitrary code execution are scored 10.0 with no privileges required (CVE-2026-90532, CVE-2026-48383, CVE-2026-48382), fixed by Cloud Service 2026.9.28386 and, on 6.5 and 6.5 LTS, by per-issue hotfixes, and Adobe is not aware of exploits of these either (Adobe Experience Manager APSB26-152, 2026-10-13). Commerce and Magento APSB26-153 fixes a template-engine injection leading to code execution (CVE-2026-103849, 10.0, which Adobe marks as needing no authentication) and an incorrect-authorization code-execution flaw (CVE-2026-92909, 9.8, which Adobe's note tags B2B) in builds up to the 2026-sep release; the fixes are the 2026-oct builds, Adobe Commerce B2B has its own 2026-oct builds, Magento Open Source gets them for 2.4.9, 2.4.8 and 2.4.7, and Adobe asks customers to apply the CVE-2026-75650 hotfix from its September APSB26-146 update as well, and Adobe is likewise not aware of exploits (Adobe Commerce APSB26-153, 2026-10-13).

Builds on: Adobe's August bulletins carry three separate unauthenticated, maximum-severity code-execution… · Adobe rates its own emergency hotfix priority 1 for a flaw stores were already being…

vulnerability14 Oct 03:41Zsingle-sourceOpen finding →
Sources: Adobe

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • adobe.com3 (100%)

External references

NVD · cve.org · CISA KEV

All cited sources (3)