Adobe Experience Manager 6.5.0 < 6.5.3 / 2026.7.0 < 2026.8.0 Multiple Vulnerabilities (APSB26-98)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(344294);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/09");

  script_cve_id(
    "CVE-2025-64542",
    "CVE-2025-64584",
    "CVE-2025-64588",
    "CVE-2025-64589",
    "CVE-2025-64610",
    "CVE-2025-64618",
    "CVE-2025-64830",
    "CVE-2025-64838",
    "CVE-2025-64854",
    "CVE-2025-64866",
    "CVE-2025-64868",
    "CVE-2025-66516",
    "CVE-2026-18401",
    "CVE-2026-19232",
    "CVE-2026-19479",
    "CVE-2026-19612",
    "CVE-2026-19644",
    "CVE-2026-19713",
    "CVE-2026-27222",
    "CVE-2026-27227",
    "CVE-2026-27238",
    "CVE-2026-27258",
    "CVE-2026-71356",
    "CVE-2026-71357",
    "CVE-2026-71388",
    "CVE-2026-71440",
    "CVE-2026-71565",
    "CVE-2026-72626",
    "CVE-2026-72627",
    "CVE-2026-75629",
    "CVE-2026-75635",
    "CVE-2026-75636",
    "CVE-2026-75637",
    "CVE-2026-75639",
    "CVE-2026-75640",
    "CVE-2026-75642",
    "CVE-2026-75643",
    "CVE-2026-75644",
    "CVE-2026-75646",
    "CVE-2026-75647",
    "CVE-2026-75651",
    "CVE-2026-75652",
    "CVE-2026-75657",
    "CVE-2026-75659",
    "CVE-2026-75660",
    "CVE-2026-75661",
    "CVE-2026-75666",
    "CVE-2026-75667",
    "CVE-2026-75668",
    "CVE-2026-75669",
    "CVE-2026-75670",
    "CVE-2026-75671",
    "CVE-2026-75672",
    "CVE-2026-75674",
    "CVE-2026-75675",
    "CVE-2026-75677",
    "CVE-2026-75678",
    "CVE-2026-75679",
    "CVE-2026-75680",
    "CVE-2026-75681",
    "CVE-2026-75683",
    "CVE-2026-75685",
    "CVE-2026-75687",
    "CVE-2026-75690",
    "CVE-2026-75691",
    "CVE-2026-75692",
    "CVE-2026-75693",
    "CVE-2026-75694",
    "CVE-2026-75695",
    "CVE-2026-75696",
    "CVE-2026-75700",
    "CVE-2026-75701",
    "CVE-2026-75702",
    "CVE-2026-75704",
    "CVE-2026-75705",
    "CVE-2026-75706",
    "CVE-2026-75707",
    "CVE-2026-75708",
    "CVE-2026-75709",
    "CVE-2026-75710",
    "CVE-2026-75711",
    "CVE-2026-75712",
    "CVE-2026-75713",
    "CVE-2026-75714",
    "CVE-2026-75715",
    "CVE-2026-75716",
    "CVE-2026-75717",
    "CVE-2026-75718",
    "CVE-2026-75719",
    "CVE-2026-75720",
    "CVE-2026-75722",
    "CVE-2026-75724",
    "CVE-2026-75725",
    "CVE-2026-75726",
    "CVE-2026-75727",
    "CVE-2026-75729",
    "CVE-2026-75730",
    "CVE-2026-75731",
    "CVE-2026-75733",
    "CVE-2026-75734",
    "CVE-2026-75735",
    "CVE-2026-75736",
    "CVE-2026-75737",
    "CVE-2026-75738",
    "CVE-2026-75739",
    "CVE-2026-75740",
    "CVE-2026-75741",
    "CVE-2026-75742",
    "CVE-2026-79905"
  );

  script_name(english:"Adobe Experience Manager 6.5.0 < 6.5.3 / 2026.7.0 < 2026.8.0 Multiple Vulnerabilities (APSB26-98)");

  script_set_attribute(attribute:"synopsis", value:
"The Adobe Experience Manager instance installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Adobe Experience Manager installed on the remote host is prior to 2026.8.0, 6.5.3. It is, therefore,
affected by multiple vulnerabilities as referenced in the APSB26-98 advisory.

  - Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers
    (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a
    crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However,
    this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the
    vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix
    were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2
    would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases,
    the PDFParser was in the org.apache.tika:tika-parsers module. (CVE-2025-66516)

  - The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength
    constraint defined in StreamReadConstraints (default: 1000 characters). An attacker able to submit JSON to
    an application that uses the async parser API can supply a number token of arbitrary length, leading to
    excessive memory allocation and potential CPU exhaustion, resulting in a denial of service. The
    synchronous parser enforces this limit correctly, so the constraint is applied inconsistently depending on
    which parsing API the application uses. Root cause: the async parsing path in
    NonBlockingUtf8JsonParserBase and related classes never invokes the number length validation methods.
    Number parsing methods such as _finishNumberIntegralPart() accumulate digits into the TextBuffer without
    any length check, then call _valueComplete() to finalize the token. _valueComplete() does not call
    resetInt() or resetFloat(), which are the methods in ParserBase where validateIntegerLength() and
    validateFPLength() are performed. Because that validation step is skipped, maxNumberLength is never
    enforced on the async code path. Impact: an attacker sending a JSON document containing an arbitrarily
    long number to an application using the async parser (for example a Spring WebFlux or other reactive
    application) can cause unbounded allocation in the TextBuffer and an OutOfMemoryError. If the application
    subsequently calls getBigIntegerValue() or getDecimalValue(), the JVM may additionally be tied up in
    O(n^2) BigInteger parsing, causing CPU-based denial of service. No privileges or user interaction beyond
    the ability to submit data for parsing are required. This issue affects
    com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.5 and from 2.19.0 through 2.21.0,
    and tools.jackson.core:jackson-core from 3.0.0 through 3.0.x. Versions prior to 2.15.0 are not affected,
    because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in
    jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that
    GHSA-72hv-8253-57qq records the lower bound of the affected 2.x range as 2.0.0. (CVE-2026-18401)

  - Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in
    arbitrary code execution in the context of the current user, potentially gaining elevated access or
    control over the victim's account or session. A low-privileged attacker could exploit this vulnerability
    to gain elevated access or control over the victim's account or session. Exploitation of this issue does
    not require user interaction. Scope is changed. (CVE-2026-19232)

  - Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be
    abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious
    JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable
    field. Scope is changed. (CVE-2025-64584, CVE-2025-64588, CVE-2025-64589, CVE-2025-64610, CVE-2025-64618,
    CVE-2025-64830, CVE-2025-64838, CVE-2025-64854, CVE-2025-64866, CVE-2025-64868, CVE-2026-27222,
    CVE-2026-27227, CVE-2026-27238, CVE-2026-27258, CVE-2026-71440, CVE-2026-75642, CVE-2026-75643,
    CVE-2026-75644, CVE-2026-75727, CVE-2026-75729, CVE-2026-75730, CVE-2026-75731, CVE-2026-75733,
    CVE-2026-75734, CVE-2026-75735, CVE-2026-75736, CVE-2026-75737, CVE-2026-75738, CVE-2026-75739,
    CVE-2026-75740, CVE-2026-75741, CVE-2026-75742, CVE-2026-79905)

  - Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker
    could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the
    context of the victim's browser. Exploitation of this issue requires user interaction in that a victim
    must visit a crafted webpage. Scope is changed. (CVE-2025-64542, CVE-2026-19479, CVE-2026-19612,
    CVE-2026-19644, CVE-2026-19713, CVE-2026-71356, CVE-2026-71357, CVE-2026-71388, CVE-2026-71565,
    CVE-2026-72626, CVE-2026-72627, CVE-2026-75629, CVE-2026-75635, CVE-2026-75636, CVE-2026-75637,
    CVE-2026-75639, CVE-2026-75640, CVE-2026-75646, CVE-2026-75647, CVE-2026-75651, CVE-2026-75652,
    CVE-2026-75657, CVE-2026-75659, CVE-2026-75660, CVE-2026-75661, CVE-2026-75666, CVE-2026-75667,
    CVE-2026-75668, CVE-2026-75669, CVE-2026-75670, CVE-2026-75671, CVE-2026-75672, CVE-2026-75674,
    CVE-2026-75675, CVE-2026-75677, CVE-2026-75678, CVE-2026-75679, CVE-2026-75680, CVE-2026-75681,
    CVE-2026-75683, CVE-2026-75685, CVE-2026-75687, CVE-2026-75690, CVE-2026-75691, CVE-2026-75692,
    CVE-2026-75693, CVE-2026-75694, CVE-2026-75695, CVE-2026-75696, CVE-2026-75700, CVE-2026-75701,
    CVE-2026-75702, CVE-2026-75704, CVE-2026-75705, CVE-2026-75706, CVE-2026-75707, CVE-2026-75708,
    CVE-2026-75709, CVE-2026-75710, CVE-2026-75711, CVE-2026-75712, CVE-2026-75713, CVE-2026-75714,
    CVE-2026-75715, CVE-2026-75716, CVE-2026-75717, CVE-2026-75718, CVE-2026-75719, CVE-2026-75720,
    CVE-2026-75722, CVE-2026-75724, CVE-2026-75725)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?51ca69ff");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Adobe Experience Manager version 2026.8.0, 6.5.3 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-66516");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-18401");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20, 79, 863);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/09");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:experience_manager");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("adobe_experience_manager_http_detect.nbin");
  script_require_keys("installed_sw/Adobe Experience Manager");

  exit(0);
}

include('vcf.inc');
include('http.inc');

var port = get_http_port(default:4502);
var app_info = vcf::get_app_info(app:'Adobe Experience Manager', port:port);

vcf::check_granularity(app_info:app_info, sig_segments:2);

var constraints = [
  { 'min_version' : '6.5.0', 'fixed_version' : '6.5.3', 'fixed_display' : '6.5.25 / 6.5.3' },
  { 'min_version' : '2026.7.0', 'fixed_version' : '2026.8.0' }
];
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    require_paranoia:TRUE,
    severity:SECURITY_HOLE,
    flags:{'xss':TRUE}
);