Adobe Experience Manager Fixes Missing-Auth and SSRF Flaws
The important change is the product shift: this is now an Adobe Experience Manager patch advisory, and the key risks are unauthorized writes and server-side trust abuse. One flaw skips the login check on a critical write path, so an outsider can make changes without user interaction. Another is an SSRF issue that can let a low-privilege attacker push the server into requests it should never make, with reach into accounts or sessions.
NCSC-2026-0246 lists multiple fixed AEM CVEs, including missing-auth, SSRF, path traversal, XSS, XXE, request splitting, and request smuggling issues. Adobe says it has no confirmed active exploitation. The practical point is that patching AEM is not just about closing one bug; it is about removing ways for a public-facing CMS to alter content, pivot into internal services, or expose session and account data.
For teams running AEM, the failure mode is a broken trust boundary between public web input and back-end actions. The open question now is patch state across exposed CMS instances, not incident response.
Adobe heeft meerdere kwetsbaarheden verholpen in Adobe Experience Manager. De kwetsbaarheden in Adobe Experience Manager omvatten onder andere het ontbreken van authenticatie op een kritieke functie, waardoor onbevoegde schrijfacties mogelijk zijn zonder gebruikersinteractie. Daarnaast is er een Server-Side Request Forgery (SSRF) kwetsbaarheid die een...
Adobe heeft meerderen kwetsbaarheden verholpen in Adobe ColdFusion versies 25.10, 23.21 en eerdere versies. De genoemde kwetsbaarheden kunnen leiden tot de volgende categorieen van schade: - Willekeurig uitvoeren van code - Onrechtmatig verhogen van privileges - Uitlezen van willekeurige bestanden - Omzeilen van beveiligingsmaatregelen Adobe is op het moment...
Mozilla ha rilasciato aggiornamenti di sicurezza per risolvere due nuove vulnerabilità che risultano essere sfruttate attivamente in rete, entrambe di gravità “critica”, riguardanti il prodotto Mozilla Firefox.