Adobe Experience Manager APSB26-152: two CVSS 10.0 incorrect-authorisation flaws (CVE-2026-48382, CVE-2026-48383) allow unauthenticated arbitrary code execution; fixed in AEM as a Cloud Service 2026.9.28386 and GRANITE-72352 hotfixes for 6.5 and 6.5 LTS

Adobe published security bulletin APSB26-152 for Adobe Experience Manager (AEM), with CVE records released on 13 October 2026, its October Patch Tuesday. CVE-2026-48382 and CVE-2026-48383 are incorrect-authorisation flaws (CWE-863) that Adobe says could result in arbitrary code execution, potentially giving the attacker elevated access or control over a victim's account or session. Adobe scores both 10.0 (CVSS 3.1: network, low complexity, no privileges, no user interaction, scope changed). Affected releases are AEM as a Cloud Service up to 2026.9.28187, AEM 6.5 LTS up to SP3, and AEM 6.5 up to 6.5.25. Fixes are AEM as a Cloud Service 2026.9.28386 and a hotfix for GRANITE-72352 on 6.5 LTS SP1 to SP3 and on AEM 6.5.20 to 6.5.25. Adobe's bulletin page refused our automated fetch (403), so details come from Adobe's own CVE records. No exploitation has been reported. This is separate from the September AEM Forms bulletin (APSB26-151) on this desk. Adobe also released ColdFusion bulletin APSB26-144 the same day (high-privilege code execution and SSRF bugs, fixed in ColdFusion 2025.0.14 and 2023.0.26 per Adobe's CVE records).

Product

Adobe Experience Manager (AEM as a Cloud Service, AEM 6.5 LTS, AEM 6.5)

Versions

AEM as a Cloud Service up to 2026.9.28187; AEM 6.5 LTS up to SP3; AEM 6.5 up to 6.5.25. Fixed: Cloud Service 2026.9.28386; GRANITE-72352 hotfix for 6.5 LTS SP1–SP3 and 6.5.20–6.5.25.

CVSS

10.0 (CVSS 3.1, Adobe) for CVE-2026-48382 and CVE-2026-48383

Exploited in Australia?

unknown

Patch to

On AEM 6.5 or 6.5 LTS, install the GRANITE-72352 hotfix from APSB26-152 now (on 6.5 releases older than 6.5.20, move to a supported service pack first). Confirm AEM as a Cloud Service environments are on 2026.9.28386 or later. Keep AEM author instances off the open internet and review dispatcher filtering.

Primary: Adobe — APSB26-152 Security update available for Adobe Experience Manager (Oct 2026) · Vendor: CVE record — CVE-2026-48382 Adobe Experience Manager Incorrect Authorization (Adobe CNA; 13 Oct 2026) · CVE: CVE-2026-48382, CVE-2026-48383 · CVE record — CVE-2026-48383 Adobe Experience Manager Incorrect Authorization (Adobe CNA; 13 Oct 2026)

vulnerabilities cloud