The Exploit Bulletin — Monday, October 19, 2026: 1 issue requires action
Monday, October 19, 2026 — 1 issue requires action. If you run none of the software below, you are done.
Affects: Adobe Experience Manager
1. Pre-auth RCE chain and high-impact servlet flaws in Adobe Experience Manager
UNVERIFIED PUBLIC REPORT · NO CVE · REMOTE CODE EXECUTION · CRITICAL
A credible research team has published a detailed pre-auth RCE write-up against a widely deployed enterprise CMS, and Adobe advisories (APSB26-152/APSB26-56) are available — patch before exploitation follows publication.
Researchers at Searchlight Cyber describe a chain of pre-authentication flaws in Adobe Experience Manager: unauthenticated DAM bulk import (VULN-34973), stored XSS via DownloadServlet (VULN-34975), XXE in XmlSchemaReader via CreateCoralTreeServlet (VULN-34976) and Groovy execution via /bin/asynccommand (VULN-34977). They state the full unauthenticated RCE chain works against AEM Cloud (Adobe's hosted service, now patched) but that several steps are high-impact on their own and that on-premises instances should also be upgraded. The report does not state precise affected on-premises versions, and the exact exploitability of the full chain on self-hosted AEM is not detailed. AEM publish instances are reachable anonymously on the public internet behind the dispatcher.
Affected: not stated — the report concerns on-premises Adobe Experience Manager
How to Test: Determine whether you run AEM on-premises and whether your build predates the APSB26-152 fix. The named primitives to check are the BulkImportConfigServlet, DownloadServlet inline selector, CreateCoralTreeServlet (XXE), and Groovy execution via /bin/asynccommand; verify your dispatcher configuration blocks these author-only servlet paths on publish instances.
How to Patch: Apply Adobe's AEM security updates referenced in APSB26-152 and upgrade on-premises AEM to the fixed release; harden the dispatcher to deny the affected servlet paths in the interim.
Evidence: Searchlight Cyber research write-up (not on allowlist)
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
