Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Redirect (Open Redirect) vulnerability that could lead to account takeover. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site. Exploitation of this issue requires user interaction in that a victim must click on a malicious link.

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Redirect (Open Redirect) vulnerability that could result in a Security feature bypass. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site. Exploitation of this issue requires user interaction in that a victim must click on a malicious link. Scope is changed.

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

[{"vendor":"Adobe","product":"Adobe Experience Manager","defaultStatus":"affected","versions":[{"version":"0","lessThanOrEqual":"2026.04","versionType":"semver","status":"affected"}]}]

[{"vendor":"Adobe","product":"Adobe Experience Manager","defaultStatus":"affected","versions":[{"version":"0","lessThanOrEqual":"6.5.24","versionType":"semver","status":"affected"},{"version":"0","lessThanOrEqual":"LTS SP1","versionType":"semver","status":"affected"},{"version":"0","lessThanOrEqual":"2026.04","versionType":"semver","status":"affected"}]}]

Title: Adobe Experience Manager, Description: Adobe Experience Manager versiones 6.5.24, LTS SP1, 2026.04 y anteriores están afectadas por una vulnerabilidad de redirección incorrecta (redirección abierta) que podría llevar a la toma de control de la cuenta. Un atacante podría construir una URL maliciosa que redirige a una víctima a un sitio controlado por el atacante. La explotación de este problema requiere interacción del usuario en el sentido de que una víctima debe hacer clic en un enlace malicioso.

{"timestamp":"2026-06-09T17:35:28.783073Z","id":"CVE-2026-47991","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Adobe","product":"Adobe Experience Manager","defaultStatus":"affected","versions":[{"version":"0","lessThanOrEqual":"2026.04","versionType":"semver","status":"affected"}]}]

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OR
          *cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*
          *cpe:2.3:a:adobe:experience_manager:6.5:sp1:*:*:lts:*:*:*
          *cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:* versions up to (excluding) 6.5.25.0
          *cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:* versions up to (excluding) 2026.5.0

Adobe Systems Incorporated: https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html Types: Vendor Advisory

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Redirect (Open Redirect) vulnerability that could lead to account takeover. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site. Exploitation of this issue requires user interaction in that a victim must click on a malicious link.

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE-601

https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html