The version of Adobe Experience Manager installed on the remote host is prior to 2026.9.28386. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-152 advisory.

  - Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in     arbitrary code execution in the context of the current user, potentially gaining elevated access or     control over the victim's account or session. Exploitation of this issue does not require user     interaction. Scope is changed. (CVE-2026-48382, CVE-2026-48383, CVE-2026-75732, CVE-2026-90532)

  - Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS     Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the     context of the current user. A low-privileged attacker could exploit this vulnerability to execute     arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
    (CVE-2026-103848)

  - Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in     arbitrary code execution in the context of the current user, potentially gaining elevated access or     control over the victim's account or session. Exploitation of this issue does not require user     interaction. Scope is changed. (CVE-2026-105895)

  - Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in     arbitrary code execution in the context of the current user. An attacker with high privileges could     exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user     interaction. Scope is changed. (CVE-2026-106626)

  - Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker     could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the     context of the victim's browser. Exploitation of this issue requires user interaction in that a victim     must visit a crafted webpage. Scope is changed. (CVE-2026-106628, CVE-2026-106632, CVE-2026-107682,     CVE-2026-110074, CVE-2026-110075, CVE-2026-110076, CVE-2026-110077, CVE-2026-110078, CVE-2026-110079,     CVE-2026-110080, CVE-2026-48398, CVE-2026-83958, CVE-2026-83960)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Adobe Experience Manager 2026.0.0 < 2026.9.28386 Multiple Vulnerabilities (APSB26-152)

critical Nessus Plugin ID 365771

Version 1.2

Version 1.1

Version 1.2 Oct 15, 2026, 8:27 AM CVSS metrics ("CVSSv2 score" set to 9.4) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N") CVSSv2 score source (changed from "CVE-2026-48383" to "CVE-2026-106629") Plugin Feed: 202610150827
Version 1.1 Oct 14, 2026, 10:44 PM New Plugin Feed: 202610142244