Medium severity6.1NVD Advisory· Published Jun 9, 2026· Updated Aug 28, 2026
CVE-2026-47991
CVE-2026-47991
Description
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Redirect (Open Redirect) vulnerability that could result in a Security feature bypass. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site. Exploitation of this issue requires user interaction in that a victim must click on a malicious link. Scope is changed.
Affected products
5cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*+ 4 more
- cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*range: <6.5.25.0
- cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*range: <2026.5.0
- cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*
- cpe:2.3:a:adobe:experience_manager:6.5:sp1:*:*:lts:*:*:*
- (no CPE)range: <=6.5.24, <=LTS SP1, <=2026.04
Patches
Vulnerability mechanics
References
1- helpx.adobe.com/security/products/experience-manager/apsb26-56.htmlnvdVendor Advisory
News mentions
1- Adobe Experience Manager: 25 Vulnerabilities Disclosed, Mostly Stored and DOM XSSVypr Intelligence · Jun 9, 2026