CVE-2016-0956 Exposure of Sensitive Information to an Unauthorized Actor in Apache Sling Servlets Post

What is CVE-2016-0956?

CVE-2016-0956 is a high-severity vulnerability in Adobe Experience Manager, published on 10 Feb 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.

Weakness: CWE-200

Which versions are affected by CVE-2016-0956?

2 open source packages ship an affected version, including org.apache.sling:org.apache.sling.servlets.post. It affects 2 products.

Products include Adobe Experience Manager, Apache Sling.

How do I fix CVE-2016-0956?

Upgrade org.apache.sling:org.apache.sling.servlets.post to 2.3.8 or later.

Is CVE-2016-0956 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-0956 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in Adobe Experience Manager

• CVE-2026-90532 Adobe Experience Manager | Incorrect Authorization (CWE-863) Critical 10.0
• CVE-2026-105895 Adobe Experience Manager | Improper Input Validation (CWE-20) Critical 9.9
• CVE-2026-19232 Adobe Experience Manager | Incorrect Authorization (CWE-863) Critical 9.9
• CVE-2025-49533 Adobe Experience Manager (MS) | Deserialization of Untrusted Data (CWE-502) Critical 9.8
• CVE-2021-40722 AEM Forms Improper Restriction of XML External Entity Reference Critical 9.8

All Adobe Experience Manager vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m27m-628v-xxp2.