CVE-2026-106634

Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnerability to write files to unauthorized locations on the file system. Exploitation of this issue does not require user interaction. Scope is changed.

• CWE-22

• https://helpx.adobe.com/security/products/experience-manager/apsb26-152.html

Published

Oct 13, 2026

Last Modified

Oct 17, 2026

Status

Undergoing Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-106629Adobe Experience Manager is affected by a stored Cross-Site …9.3
• CVE-2026-10663In Zephyr's experimental USB host stack (CONFIG_USB_HOST_STA…6.1
• CVE-2026-106630Adobe Experience Manager is affected by a stored Cross-Site …9.3
• CVE-2026-106631Adobe Experience Manager is affected by a stored Cross-Site …5.4
• CVE-2026-106632Adobe Experience Manager is affected by a DOM-based Cross-Si…5.4
• CVE-2026-106633Adobe Experience Manager is affected by a stored Cross-Site …5.4
• CVE-2026-10664The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_e…5
• CVE-2026-106646The Classified Listing WordPress plugin before 6.1.1 does n…5.9
• CVE-2026-10665In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), …7.4
• CVE-2026-10666parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipadd…9.8
• CVE-2026-10667Zephyr's dynamic kernel-object tracking (kernel/userspace/us…7.8
• CVE-2026-10668The Nuvoton NuMaker HSUSBD USB device-controller driver (dri…4.6