Pre-auth RCE chain and high-impact servlet flaws in Adobe Experience Manager
A credible research team has published a detailed pre-auth RCE write-up against a widely deployed enterprise CMS, and the researchers say Adobe has patched the cloud chain and on-premises instances should be upgraded — patch before exploitation follows publication.
Researchers at Searchlight Cyber describe a chain of pre-authentication flaws in Adobe Experience Manager: unauthenticated DAM bulk import (VULN-34973), stored XSS via DownloadServlet (VULN-34975), XXE in XmlSchemaReader via CreateCoralTreeServlet (VULN-34976) and Groovy execution via /bin/asynccommand (VULN-34977). They state the full unauthenticated RCE chain works against AEM Cloud (Adobe's hosted service, now patched) but that several steps are high-impact on their own and that on-premises instances should also be upgraded. The report does not state precise affected on-premises versions, and the exact exploitability of the full chain on self-hosted AEM is not detailed. AEM publish instances are reachable anonymously on the public internet behind the dispatcher.
Affected: not stated — the report concerns on-premises Adobe Experience Manager
How to Test
Determine whether you run AEM on-premises and whether your build predates the APSB26-152 fix. The named primitives to check are the BulkImportConfigServlet, DownloadServlet inline selector, CreateCoralTreeServlet (XXE), and Groovy execution via /bin/asynccommand; verify your dispatcher configuration blocks these author-only servlet paths on publish instances.
How to Patch
Apply Adobe's current AEM security updates and upgrade on-premises AEM to the fixed release; harden the dispatcher to deny the affected servlet paths in the interim.