CVE-2026-103848 Command injection in Adobe Experience Manager 6.5
A low-privileged attacker can execute arbitrary code via OS command injection in Adobe Experience Manager without user interaction.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-103848?
CVE-2026-103848 is a critical command injection vulnerability in Adobe Experience Manager 6.5, published on 13 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Weakness: CWE-78
Which versions are affected by CVE-2026-103848?
How do I fix CVE-2026-103848?
No fix has been published for CVE-2026-103848 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-103848 being exploited?
There is no known exploitation of CVE-2026-103848 in the wild and no public exploit code.
Sources
Also known as GHSA-w4w5-pv6q-gm74.