EM
Product
Experience Manager
1,272
CVEs
0
On KEV
9.9
Max CVSS
6
New 30D
Severity mix
Critical 19High 30Medium 451Low 0
Watch
Add Experience Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-105895 | 9.9 | Oct 13 | Adobe Experience Manager | Improper Input Validation (CWE-20) Affected: through 6.5; through 6.5.25.0; through 2026.9.28187 |
| CVE-2026-19232 | 9.9 | Sep 8 | Adobe Experience Manager | Incorrect Authorization (CWE-863) Affected: before 6.5; before 6.5.25.0; before 2026.8.0; 6.5; 6.5; 6.5 |
| CVE-2025-49533 | 9.8 | Jul 8 | Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an… Affected: through 6.5.23.0 |
| CVE-2024-26029 | 9.8 | Jun 13 | Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass Affected: before 6.5.21; before 2024.5 |
| CVE-2021-40722 | 9.8 | Jan 13 | AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker… Affected: through 6.5.10.0 |
| CVE-2019-8088 | 9.8 | Oct 25 | Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a command injection vulnerability Affected: 6.2; 6.3; 6.4; 6.5 |
| CVE-2019-7964 | 9.8 | Aug 16 | Adobe Experience Manager versions 6.5, and 6.4 have an authentication bypass vulnerability Affected: 6.4; 6.5 |
| CVE-2017-3108 | 9.8 | Aug 11 | Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability Affected: through 6.2 |
| CVE-2026-48259 | 9.6 | Jul 14 | Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 6.5.25.0; through 2020.5.0; 6.5; 6.5; 6.5 |
| CVE-2026-48359 | 9.6 | Jul 14 | Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) Affected: through 6.5.25.0; through 2020.5.0; 6.5; 6.5; 6.5 |
| CVE-2026-106630 | 9.3 | Oct 13 | Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 6.5; through 6.5.25.0 |
| CVE-2026-106629 | 9.3 | Oct 13 | Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 6.5; through 6.5.25.0 |
| CVE-2026-34691 | 9.3 | Jun 9 | Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 6.5.24.0; 6.5; 6.5 |
| CVE-2025-64539 | 9.3 | Dec 10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code execution Affected: before 6.5.24.0; before 2025.12.0; 6.5 |
| CVE-2025-64538 | 9.3 | Dec 10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code execution Affected: before 6.5.24.0; before 2025.12.0; 6.5 |
| CVE-2025-64537 | 9.3 | Dec 10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code execution Affected: before 6.5.24.0; before 2025.12.0; 6.5 |
| CVE-2026-106626 | 9.1 | Oct 13 | Adobe Experience Manager | Improper Input Validation (CWE-20) Affected: through 6.5; through 6.5.25.0; through 2026.9.28187 |
| CVE-2020-24445 | 9.0 | Dec 10 | AEM's Cloud Service offering, as well as version 6.5.6.0 (and below), are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to… Affected: through 6.5.6.0 |
| CVE-2020-9732 | 9.0 | Sep 10 | The AEM Forms add-on for versions 6.5.5.0 (and below) and 6.4.8.2 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store… Affected: through 6.2.1.20; 6.3.0.0 through 6.3.3.8; 6.4.0.0 through 6.4.8.1; 6.5.0.0 through 6.5.5.0 |
| CVE-2021-28627 | 8.8 | Aug 24 | Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by a Server-side Request Forgery Affected: through 6.5.8.0 |
| CVE-2016-7885 | 8.8 | Dec 15 | Adobe Experience Manager versions 6.2 and earlier have a vulnerability that could be used in Cross-Site Request Forgery attacks Affected: through 6.2.0 |
| CVE-2025-46840 | 8.7 | Jun 10 | Adobe Experience Manager versions 6.5.22 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation Affected: before 6.5.23.0; before 2025.5.0 |
| CVE-2025-46837 | 8.7 | Jun 10 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to… Affected: before 6.5.23.0; before 2025.5.0 |
| CVE-2026-48310 | 8.6 | Jul 14 | Adobe Experience Manager | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 6.5.25.0; through 2020.5.0; 6.5; 6.5; 6.5 |
| CVE-2026-48252 | 8.6 | Jul 14 | Adobe Experience Manager | Missing Authentication for Critical Function (CWE-306) Affected: through 6.5.25.0; through 2020.5.0; 6.5; 6.5; 6.5 |
| CVE-2026-34693 | 8.0 | Jun 9 | Adobe Experience Manager Forms JEE | Cross-site Scripting (Reflected XSS) (CWE-79) Affected: through 6.5.24.0; 6.5; 6.5 |
| CVE-2025-54248 | 7.7 | Sep 9 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass Affected: through 6.5.23.0; through 2025.8.0; 6.5; 6.5 |
| CVE-2021-28626 | 7.5 | Aug 24 | Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by an Improper Authorization vulnerability allowing users to create nodes… Affected: through 6.5.8.0 |
| CVE-2021-21083 | 7.5 | Jun 28 | AEM's Cloud Service offering, as well as versions 6.5.7.0 (and below), 6.4.8.3 (and below) and 6.3.3.8 (and below) are affected by an Improper Access Control vulnerability Affected: through 6.3.3.8; 6.4.0.0 before 6.4.8.4; 6.5.0.0 before 6.5.8.0 |
| CVE-2020-9733 | 7.5 | Sep 10 | An AEM java servlet in AEM versions 6.5.5.0 (and below) and 6.4.8.1 (and below) executes with the permissions of a high privileged service user Affected: through 6.2.1.20; 6.3.0.0 through 6.3.3.8; 6.4.0.0 through 6.4.8.1; 6.5.0.0 through 6.5.5.0 |
| CVE-2020-9645 | 7.5 | Jun 12 | Adobe Experience Manager versions 6.5 and earlier have a blind server-side request forgery (ssrf) vulnerability Affected: 6.4 before 6.4.8.1; 6.5 before 6.5.5.0 |
| CVE-2020-9643 | 7.5 | Jun 12 | Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability Affected: 6.4 before 6.4.8.1; 6.5 before 6.5.5.0 |
| CVE-2020-3769 | 7.5 | Mar 25 | Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability Affected: 6.1.0 through 6.5.0 |
| CVE-2020-3741 | 7.5 | Feb 13 | Adobe Experience Manager versions 6.5, and 6.4 have an uncontrolled resource consumption vulnerability Affected: 6.4; 6.5 |
| CVE-2019-16469 | 7.5 | Jan 15 | Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have an expression language injection vulnerability Affected: 6.5.0 before 6.5.3.0 |
| CVE-2019-16468 | 7.5 | Jan 15 | Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have an user interface injection vulnerability Affected: 6.3 before 6.3.3.7; 6.4 before 6.4.7.0; 6.5 before 6.5.3.0 |
| CVE-2019-8087 | 7.5 | Oct 25 | Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability Affected: 6.2; 6.3; 6.4; 6.5 |
| CVE-2019-8086 | 7.5 | Oct 25 | Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability Affected: 6.2; 6.3; 6.4; 6.5 |
| CVE-2019-8082 | 7.5 | Oct 25 | Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability Affected: 6.2; 6.3; 6.4 |
| CVE-2019-8081 | 7.5 | Oct 25 | Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have an authentication bypass vulnerability Affected: 6.2; 6.3; 6.4; 6.5 |
| CVE-2018-5006 | 7.5 | Jul 20 | Adobe Experience Manager versions 6.4 and earlier have a Server-Side Request Forgery vulnerability Affected: through 6.4.0 |
| CVE-2018-5004 | 7.5 | Jul 20 | Adobe Experience Manager versions 6.2 and 6.3 have a Server-Side Request Forgery vulnerability Affected: 6.2.0 before 6.4.0 |
| CVE-2018-12809 | 7.5 | Jul 20 | Adobe Experience Manager versions 6.4 and earlier have a Server-Side Request Forgery vulnerability Affected: through 6.4.0 |
| CVE-2017-3111 | 7.5 | Dec 9 | An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0 Affected: 6.1.0; 6.2.0 |
| CVE-2017-3110 | 7.5 | Aug 11 | Adobe Experience Manager 6.1 and earlier has a sensitive data exposure vulnerability Affected: through 6.1 |
| CVE-2017-3107 | 7.5 | Aug 11 | Adobe Experience Manager 6.3 and earlier has a misconfiguration vulnerability Affected: through 6.3 |
| CVE-2016-0958 | 7.5 | Feb 10 | Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 might allow remote attackers to have an unspecified impact via a crafted serialized Java object Affected: 5.6.1; 6.0.0; 6.1.0 |
| CVE-2016-0957 | 7.5 | Feb 10 | Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote attackers to bypass dispatcher rules via… Affected: 5.6.1; 6.0.0; 6.1.0 |
| CVE-2016-0956 | 7.5 | Feb 10 | The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via… Affected: 5.6.1; 6.0.0; 6.1.0 |
| CVE-2025-54249 | 6.5 | Sep 9 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass Affected: through 6.5.23.0; through 2025.8.0; 6.5; 6.5 |
The 500 most important CVEs for this product (exploited first, then by severity)