CVE-2026-105895: Improper Input Validation (CWE-20) in Adobe Adobe Experience Manager 6.5

CVE-2026-105895 is an Improper Input Validation vulnerability in Adobe Experience Manager 6.5. It enables an attacker to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability affects versions from initial releases up to 6.5.25 inclusive. The scope of the vulnerability is changed, indicating that the impact extends beyond the initially affected component. The CVSS v3.1 base score is 9.9, reflecting critical severity with network attack vector, low attack complexity, privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to arbitrary code execution with the privileges of the current user, potentially resulting in elevated access or control over the victim's account or session. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability does not require user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, organizations should monitor Adobe's security advisories for updates. Until a fix is available, consider restricting access to Adobe Experience Manager instances and applying any recommended temporary mitigations from Adobe.