CVE-2026-90531: Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-90531 describes an XXE vulnerability in Adobe Experience Manager as a Cloud Service that permits privilege escalation. A low-privileged attacker can exploit this flaw to gain elevated access to internal resources. The vulnerability does not require user interaction and changes the security scope, potentially affecting components beyond the initial attack vector. The CVSS v3.1 base score is 9.6 (critical), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, changed scope, and high confidentiality and integrity impacts.

Successful exploitation allows an attacker with low privileges to escalate their access privileges and gain elevated access to internal resources, potentially compromising confidentiality and integrity of sensitive data. The vulnerability does not affect availability. The changed scope indicates that the impact crosses security boundaries within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe whether the service has been patched or mitigated server-side. Until official fixes are available, restrict access to the affected service and monitor for suspicious activity related to XML processing.