Vulnerabilities · 73 days ago

Adobe Experience Manager Fixes Missing-Auth and SSRF Flaws

The important change is the product shift: this is now an Adobe Experience Manager patch advisory, and the key risks are unauthorized writes and server-side trust abuse. One flaw skips the login check on a critical write path, so an outsider can make changes without user interaction. Another is an SSRF issue that can let a low-privilege attacker push the server into requests it should never make, with reach into accounts or sessions.

NCSC-2026-0246 lists multiple fixed AEM CVEs, including missing-auth, SSRF, path traversal, XSS, XXE, request splitting, and request smuggling issues. Adobe says it has no confirmed active exploitation. The practical point is that patching AEM is not just about closing one bug; it is about removing ways for a public-facing CMS to alter content, pivot into internal services, or expose session and account data.

For teams running AEM, the failure mode is a broken trust boundary between public web input and back-end actions. The open question now is patch state across exposed CMS instances, not incident response.

CVE-2026-16412

NVD KEV

CVSS 9.8 CRITICAL: memory safety bugs present in Firefox ESR 140.12 and Firefox 152. EPSS 0.5% (42nd percentile).

CVE-2026-16411

NVD KEV

CVSS 9.8 CRITICAL: memory safety bugs present in Firefox 152. EPSS 0.5% (40th percentile).

CVE-2026-16360

NVD KEV

CVSS 9.8 CRITICAL: memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. EPSS 0.5% (38th percentile).

CVE-2026-15719

NVD KEV

CVSS 5.4 MEDIUM: we are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw.

CVE-2026-15718

NVD KEV

CVSS 4.3 MEDIUM: we are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw.

Timeline

Sources

4 sources covering this story

Entities

Part of the PlainSec briefing for 2026-07-18

Editions

Related stories