Adobe Experience Manager Fixes Missing-Auth and SSRF Flaws
The important change is the product shift: this is now an Adobe Experience Manager patch advisory, and the key risks are unauthorized writes and server-side trust abuse. One flaw skips the login check on a critical write path, so an outsider can make changes without user interaction. Another is an SSRF issue that can let a low-privilege attacker push the server into requests it should never make, with reach into accounts or sessions.
NCSC-2026-0246 lists multiple fixed AEM CVEs, including missing-auth, SSRF, path traversal, XSS, XXE, request splitting, and request smuggling issues. Adobe says it has no confirmed active exploitation. The practical point is that patching AEM is not just about closing one bug; it is about removing ways for a public-facing CMS to alter content, pivot into internal services, or expose session and account data.
For teams running AEM, the failure mode is a broken trust boundary between public web input and back-end actions. The open question now is patch state across exposed CMS instances, not incident response.