Medium severity4.3NVD Advisory· Published Jun 9, 2026· Updated Jun 10, 2026
CVE-2026-47991
CVE-2026-47991
Description
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Redirect (Open Redirect) vulnerability that could lead to account takeover. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site. Exploitation of this issue requires user interaction in that a victim must click on a malicious link.
Affected products
5cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*+ 4 more
- cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*range: <6.5.25.0
- cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*
- cpe:2.3:a:adobe:experience_manager:6.5:sp1:*:*:lts:*:*:*
- cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*range: <2026.5.0
- (no CPE)range: <=6.5.24, LTS SP1, 2026.04
Patches
Vulnerability mechanics
References
1- helpx.adobe.com/security/products/experience-manager/apsb26-56.htmlnvdVendor Advisory
News mentions
1- Adobe Experience Manager: 25 Vulnerabilities Disclosed, Mostly Stored and DOM XSSVypr Intelligence · Jun 9, 2026