CVE-2026-19232: Incorrect Authorization (CWE-863) in Adobe Adobe Experience Manager as a Cloud Service

Adobe Experience Manager as a Cloud Service suffers from an Incorrect Authorization vulnerability (CWE-863) that permits a low-privileged attacker to execute arbitrary code in the context of the current user. This can result in elevated privileges or control over the victim's account or session. The vulnerability does not require user interaction and changes the scope of the attack. The CVSS v3.1 score is 9.9, indicating critical severity with network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with low privileges to gain elevated access or control over the victim's account or session, potentially leading to arbitrary code execution and full compromise of the affected user context. The vulnerability affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is not a cloud-hosted service, remediation depends on vendor patch releases. Monitor Adobe's official advisories for updates and apply patches promptly once available.