CVE-2026-47991: Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Redirect (Open Redirect) vulnerability that could result in…

PriorityP429medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.23%

14.1th percentile

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Redirect (Open Redirect) vulnerability that could result in a Security feature bypass. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site. Exploitation of this issue requires user interaction in that a victim must click on a malicious link. Scope is changed.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
adobe	adobe_experience_manager_6.5	<= 6.5.24	—
adobe	adobe_experience_manager_6.5_lts	<= SP1	—
adobe	adobe_experience_manager_as_a_cloud_service	<= 2026.4.0	—
adobe	experience_manager	< 6.5.25.0	6.5.25.0
adobe	experience_manager	< 2026.5.0	2026.5.0
adobe	experience_manager	—	—
adobe	experience_manager	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.