Bulletin-ID
Zuletzt aktualisiert am
22. Juli 2026
Sicherheits-Updates für Adobe Experience Manager verfügbar | APSB26-74
|
|
Veröffentlichungsdatum |
Priorität |
|---|---|---|
|
APSB26-74 |
14. Juli 2026 |
3 |
Zusammenfassung
Adobe hat Sicherheitsupdates für Adobe Experience Manager (AEM) veröffentlicht. Dieses Update schließt Sicherheitslücken, die als wichtig eingestuft wurden. Die erfolgreiche Ausnutzung dieser Sicherheitslücken könnte zu willkürlicher Code-Ausführung, Umgehung der Sicherheitsfunktionen, willkürlichem Dateisystem-Lesezugriff und Eskalation der Berechtigungen führen.
Adobe sind keine Fälle bekannt, in denen die in diesen Updates behobenen Sicherheitslücken ausgenutzt wurden.
Betroffene Produktversionen
Produkt |
Version |
Plattform |
|---|---|---|
| Adobe Experience Manager (AEM) |
AEM Cloud Service (CS) Version 2026.5.0 und früher | Alle |
| Adobe Experience Manager (AEM) | 6.5 LTS Service Pack 2 und früher | Alle |
| Adobe Experience Manager (AEM) | 6.5 Service Pack 25 und früher | Alle |
Lösung
Adobe empfiehlt allen Anwendern die Installation der neuesten Version und stuft die Priorität dieser Updates wie folgt ein:
Produkt |
Version |
Plattform |
Priorität |
Verfügbarkeit. |
|---|---|---|---|---|
| Adobe Experience Manager (AEM) |
AEM Cloud Service (CS) Version 2026.6.0 | Alle | 3 | Versionshinweise |
| Adobe Experience Manager (AEM) | 6.5 LTS Service Pack 2 – Hotfix für NPR-43972 | Alle | 3 | Versionshinweise |
| Adobe Experience Manager (AEM) | 6.5 Service Pack 25 – Hotfix für NPR-43971 | Alle | 3 | Versionshinweise |
Anmerkung
CVE-2026-48252, CVE-2026-48259, CVE-2026-48263, CVE-2026-48310, CVE-2026-48355 betreffen nur angegebene AEMaaCS-Versionen.
Sicherheitslückendetails
| Vulnerability Category |
Vulnerability Impact |
Severity |
CVSS base score |
CVSS vector |
CVE Number |
| Server-Side Request Forgery (SSRF) (CWE-918) | Arbitrary code execution | Critical | 9.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N | CVE-2026-48259 |
| Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) | Arbitrary code execution | Critical | 9.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N | CVE-2026-48359 |
| Missing Authentication for Critical Function (CWE-306) | Security feature bypass | Critical | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N | CVE-2026-48252 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | Arbitrary file system read | Critical | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N | CVE-2026-48310 |
| Cross-site Scripting (Stored XSS) (CWE-79) | Arbitrary code execution | Important | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CVE-2026-48263 |
| Cross-site Scripting (DOM-based XSS) (CWE-79) | Arbitrary code execution | Important | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CVE-2026-48253 |
| Cross-site Scripting (Stored XSS) (CWE-79) | Arbitrary code execution | Important | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CVE-2026-48355 |
| Cross-site Scripting (DOM-based XSS) (CWE-79) | Arbitrary code execution | Important | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CVE-2026-48254 |
| Cross-site Scripting (DOM-based XSS) (CWE-79) | Arbitrary code execution | Important | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CVE-2026-48255 |
| Cross-site Scripting (DOM-based XSS) (CWE-79) | Arbitrary code execution | Important | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CVE-2026-48257 |
| Cross-site Scripting (DOM-based XSS) (CWE-79) | Arbitrary code execution | Important | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CVE-2026-48260 |
| Cross-site Scripting (DOM-based XSS) (CWE-79) | Arbitrary code execution | Important | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CVE-2026-48261 |
| Cross-site Scripting (DOM-based XSS) (CWE-79) | Privilege escalation | Important | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CVE-2026-48262 |
Anmerkung
If a customer is using Apache httpd in a proxy with a non-default configuration, they may be impacted by CVE-2023-25690 - please read more here: https://httpd.apache.org/security/vulnerabilities_24.html
Acknowledgments
Adobe would like to thank the following for reporting these issues and for working with Adobe to help protect our customers:
- green-jam - CVE-2026-48253, CVE-2026-48254, CVE-2026-48255, CVE-2026-48257, CVE-2026-48260, CVE-2026-48261, CVE-2026-48262
- Dylan Pindur, Adam Kues, and Patrik Grobshäuser of Assetnote - CVE-2026-48252, CVE-2026-48259, CVE-2026-48263, CVE-2026-48310, CVE-2026-48355, CVE-2026-48359
NOTE: Adobe has a public bug bounty program with HackerOne. If you are interested in working with Adobe as an external security researcher, please check out https://hackerone.com/adobe
Revisions
December 18, 2025: Added CVE-2025-64538
December 10, 2025: Removed CVE-2025-64540
December 24, 2025: Added note - "AEM 6.5 and LTS versions are not impacted by the following CVEs: CVE-2025-64537, CVE-2025-64538, CVE-2025-64539."
Weitere Informationen gibt es unter https://helpx.adobe.com/de/security.html oder per E-Mail an PSIRT@adobe.com.
