Adobe Adobe Experience Manager (AEM)

Name: Adobe Adobe Experience Manager (AEM)
Brand: Adobe

productNL

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

1critical0high2medium0low

updated 2026-10-28

vulnerabilities (132)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2023-25690US	critical9.8	84.5% (100th)	Exploit	no fix	2023-03-07	≤ vers:unknown/*
CVE-2026-48310US	—	1.05% (64th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-48359US	—	1.00% (63rd)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-48259US	—	0.90% (59th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-48252US	—OT elevated	0.89% (59th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2025-64537US	—	0.74% (54th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64538US	—	0.64% (50th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64539US	—	0.48% (41st)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64610US	medium5.4	0.39% (33rd)	—	no fix	2026-09-08	≤ vers:unknown/*
CVE-2026-48355US	—	0.39% (33rd)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-48263US	—	0.39% (33rd)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2025-64542US	medium5.4	0.36% (30th)	—	no fix	2026-09-08	≤ vers:unknown/*
CVE-2026-48262US	—	0.36% (30th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-48261US	—	0.36% (30th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-48260US	—	0.36% (30th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-48257US	—	0.36% (30th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-48255US	—	0.36% (30th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-48254US	—	0.36% (30th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-48253US	—	0.36% (30th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2025-64569US	—	0.27% (20th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64551US	—	0.27% (20th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64826US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64825US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64823US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64822US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64821US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64820US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64814US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64808US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64804US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64803US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64802US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64801US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64799US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64797US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64796US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64794US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64793US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64792US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64791US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64790US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64789US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64627US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64626US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64623US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64620US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64619US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64616US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64615US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*
CVE-2025-64614US	—	0.25% (16th)	—	no fix	2025-12-10	≤ vers:unknown/*

showing 50 of 132

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')126 CVEs
CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')1 CVEs
CWE-1395Dependency on Vulnerable Third-Party Component1 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1 CVEs
CWE-306Missing Authentication for Critical Function1 CVEs
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')1 CVEs
CWE-611Improper Restriction of XML External Entity Reference1 CVEs
CWE-918Server-Side Request Forgery (SSRF)1 CVEs

sources (1)

Which sources assert this record, and when.

NLNCSC-NL (CSAF)132 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan