CVE-2026-106626: Improper Input Validation (CWE-20) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-106626 is an improper input validation vulnerability in Adobe Experience Manager as a Cloud Service. This flaw allows an attacker with high privileges to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability affects versions up to 2026.9.28187 and 6.5.25. The scope is changed, meaning the impact extends beyond the vulnerable component. The CVSS v3.1 base score is 9.1, reflecting critical impact on confidentiality, integrity, and availability.

An attacker with high privileges can exploit this vulnerability to execute arbitrary code, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability does not require user interaction, increasing the risk of exploitation. The changed scope indicates that the impact may extend beyond the initially vulnerable component, potentially affecting other parts of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the service is managed and patched server-side. Until an official fix is available, restrict high privilege access and monitor for suspicious activity related to Adobe Experience Manager.