Is CVE-2026-90531 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-90531?

CVE-2026-90531 has a CVSS v3 severity of CRITICAL (9.6).

Back

CVE-2026-90531

Description

Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.