CVE-2026-75732: Incorrect Authorization (CWE-863) in Adobe Adobe Experience Manager 6.5 LTS

CVE-2026-75732 is an Incorrect Authorization vulnerability in Adobe Experience Manager 6.5 LTS. It enables an attacker to execute arbitrary code as the current user, potentially escalating privileges or taking control of the victim's session. The vulnerability does not require user interaction and affects versions from 0 up to and including 6.5.25. The CVSS v3.1 base score is 9.9, indicating critical severity with network attack vector, low attack complexity, and no user interaction required. The scope is changed, and the impact includes high confidentiality, integrity, and availability impacts.

Successful exploitation can result in arbitrary code execution with the privileges of the current user, potentially allowing attackers to gain elevated access or control over user accounts or sessions. This can lead to full compromise of affected systems running vulnerable versions of Adobe Experience Manager 6.5 LTS.

No explicit patch or remediation information is provided in the vendor advisory or input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to Adobe Experience Manager instances and monitor for suspicious activity related to authorization anomalies.