CVE-2026-48359

Description

Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference (-XXE-) vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to read sensitive files, potentially gaining elevated access or control over the victim-s account or session. Exploitation of this issue does not require user interaction. Scope is changed.