Adobe Experience Manager 6.5.0 < 6.5.2 / 2026.5.0 < 2026.6.0 Multiple Vulnerabilities (APSB26-74)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(327021);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/17");

  script_cve_id(
    "CVE-2026-48252",
    "CVE-2026-48253",
    "CVE-2026-48254",
    "CVE-2026-48255",
    "CVE-2026-48257",
    "CVE-2026-48259",
    "CVE-2026-48260",
    "CVE-2026-48261",
    "CVE-2026-48262",
    "CVE-2026-48263",
    "CVE-2026-48310",
    "CVE-2026-48355",
    "CVE-2026-48359"
  );
  script_xref(name:"IAVA", value:"2026-A-0700");

  script_name(english:"Adobe Experience Manager 6.5.0 < 6.5.2 / 2026.5.0 < 2026.6.0 Multiple Vulnerabilities (APSB26-74)");

  script_set_attribute(attribute:"synopsis", value:
"The Adobe Experience Manager instance installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Adobe Experience Manager installed on the remote host is prior to 2026.6.0, 6.5.2. It is, therefore,
affected by multiple vulnerabilities as referenced in the APSB26-74 advisory.

  - Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory
    ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit
    this vulnerability to access sensitive files and directories outside the intended access scope.
    Exploitation of this issue does not require user interaction. Scope is changed. (CVE-2026-48310)

  - Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE')
    vulnerability that could result in arbitrary code execution in the context of the current user. A low-
    privileged attacker could exploit this vulnerability to read sensitive files, potentially gaining elevated
    access or control over the victim's account or session. Exploitation of this issue does not require user
    interaction. Scope is changed. (CVE-2026-48359)

  - Adobe Experience Manager is affected by a Server-Side Request Forgery (SSRF) vulnerability that could
    result in arbitrary code execution in the context of the current user. A low-privileged attacker could
    leverage this vulnerability to issue unauthorized server-side requests, potentially gaining elevated
    access or control over the victim's account or session. Exploitation of this issue does not require user
    interaction. Scope is changed. (CVE-2026-48259)

  - Adobe Experience Manager is affected by a Missing Authentication for Critical Function vulnerability that
    could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass
    security measures and gain unauthorized write access. Exploitation of this issue does not require user
    interaction. Scope is changed. (CVE-2026-48252)

  - Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be
    abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious
    JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable
    field. Scope is changed. (CVE-2026-48263, CVE-2026-48355)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a5710b71");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Adobe Experience Manager version 2026.6.0, 6.5.2 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-48310");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-48359");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(22, 306, 611, 79, 918);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/15");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:experience_manager");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("adobe_experience_manager_http_detect.nbin");
  script_require_keys("installed_sw/Adobe Experience Manager");

  exit(0);
}

include('vcf.inc');
include('http.inc');

var port = get_http_port(default:4502);
var app_info = vcf::get_app_info(app:'Adobe Experience Manager', port:port);

vcf::check_granularity(app_info:app_info, sig_segments:2);

var constraints = [
  { 'min_version' : '6.5.0', 'fixed_version' : '6.5.2', 'fixed_display' : '6.5.2 / 6.5.25' },
  { 'min_version' : '2026.5.0', 'fixed_version' : '2026.6.0' }
];
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    require_paranoia:TRUE,
    severity:SECURITY_HOLE,
    flags:{'xss':TRUE}
);