ID bollettino
Ultimo aggiornamento il
20 lug 2026
Aggiornamenti di sicurezza disponibili per Adobe Experience Manager | APSB26-74
|
|
Data di pubblicazione |
Priorità |
|---|---|---|
|
APSB26-74 |
14 luglio 2026 |
3 |
Riepilogo
Adobe ha rilasciato aggiornamenti per Adobe Experience Manager (AEM). Questo aggiornamento risolve vulnerabilità classificate importanti.Lo sfruttamento di queste vulnerabilità potrebbe comportare l'esecuzione di codice arbitrario, l'aggiramento delle funzionalità di sicurezza, la lettura arbitraria del file system e l'escalation dei privilegi.
Adobe non è a conoscenza di exploit delle vulnerabilità oggetto di questi aggiornamenti.
Versioni del prodotto interessate
Prodotto |
Versione |
Piattaforma |
|---|---|---|
| Adobe Experience Manager (AEM) |
AEM Cloud Service (CS) Release 2026.5.0 e versioni precedenti | Tutte |
| Adobe Experience Manager (AEM) | 6.5 LTS Service Pack 2 e versioni precedenti | Tutte |
| Adobe Experience Manager (AEM) | 6.5 Service Pack 25 e versioni precedenti | Tutte |
Soluzione
Adobe classifica questi aggiornamenti in base ai seguenti livelli di priorità e consiglia agli utenti interessati di aggiornare la propria installazione alla versione più recente:
Prodotto |
Versione |
Piattaforma |
Priorità |
Disponibilità |
|---|---|---|---|---|
| Adobe Experience Manager (AEM) |
AEM Cloud Service (CS) Release 2026.6.0 | Tutte | 3 | Note sulla versione |
| Adobe Experience Manager (AEM) | 6.5 LTS Service Pack 2 - Hotfix per NPR-43972 | Tutte | 3 | Note sulla versione |
| Adobe Experience Manager (AEM) | 6.5 Service Pack 25 - Hotfix per NPR-43971 | Tutte | 3 | Note sulla versione |
Nota
CVE-2026-48252, CVE-2026-48259, CVE-2026-48263, CVE-2026-48310, CVE-2026-48355 interessano solo le release AEMaaCS indicate.
Dettagli della vulnerabilità
| Vulnerability Category |
Vulnerability Impact |
Severity |
CVSS base score |
CVSS vector |
CVE Number |
| Server-Side Request Forgery (SSRF) (CWE-918) | Arbitrary code execution | Critical | 9.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N | CVE-2026-48259 |
| Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) | Arbitrary code execution | Critical | 9.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N | CVE-2026-48359 |
| Missing Authentication for Critical Function (CWE-306) | Security feature bypass | Critical | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N | CVE-2026-48252 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | Arbitrary file system read | Critical | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N | CVE-2026-48310 |
| Cross-site Scripting (Stored XSS) (CWE-79) | Arbitrary code execution | Important | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CVE-2026-48263 |
| Cross-site Scripting (DOM-based XSS) (CWE-79) | Arbitrary code execution | Important | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CVE-2026-48253 |
| Cross-site Scripting (Stored XSS) (CWE-79) | Arbitrary code execution | Important | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CVE-2026-48355 |
| Cross-site Scripting (DOM-based XSS) (CWE-79) | Arbitrary code execution | Important | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CVE-2026-48254 |
| Cross-site Scripting (DOM-based XSS) (CWE-79) | Arbitrary code execution | Important | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CVE-2026-48255 |
| Cross-site Scripting (DOM-based XSS) (CWE-79) | Arbitrary code execution | Important | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CVE-2026-48257 |
| Cross-site Scripting (DOM-based XSS) (CWE-79) | Arbitrary code execution | Important | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CVE-2026-48260 |
| Cross-site Scripting (DOM-based XSS) (CWE-79) | Arbitrary code execution | Important | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CVE-2026-48261 |
| Cross-site Scripting (DOM-based XSS) (CWE-79) | Privilege escalation | Important | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CVE-2026-48262 |
Nota
If a customer is using Apache httpd in a proxy with a non-default configuration, they may be impacted by CVE-2023-25690 - please read more here: https://httpd.apache.org/security/vulnerabilities_24.html
Acknowledgments
Adobe would like to thank the following for reporting these issues and for working with Adobe to help protect our customers:
- green-jam - CVE-2026-48253, CVE-2026-48254, CVE-2026-48255, CVE-2026-48257, CVE-2026-48260, CVE-2026-48261, CVE-2026-48262
- Dylan Pindur, Adam Kues, and Patrik Grobshäuser of Assetnote - CVE-2026-48252, CVE-2026-48259, CVE-2026-48263, CVE-2026-48310, CVE-2026-48355, CVE-2026-48359
NOTE: Adobe has a public bug bounty program with HackerOne. If you are interested in working with Adobe as an external security researcher, please check out https://hackerone.com/adobe
Revisions
December 18, 2025: Added CVE-2025-64538
December 10, 2025: Removed CVE-2025-64540
December 24, 2025: Added note - "AEM 6.5 and LTS versions are not impacted by the following CVEs: CVE-2025-64537, CVE-2025-64538, CVE-2025-64539."
Per ulteriori informazioni, visitare il sito https://helpx.adobe.com/it/security.html o inviare un’e-mail a PSIRT@adobe.com.
