CVE-2024-26119: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.19 and earlier are affected by an Information Exposure vulnerability (CVE-2024-26119) that could result in a security feature bypass. The vulnerability was discovered and disclosed in March 2024, with the latest update being released in December 2024. The vulnerability affects Adobe Experience Manager installations up to version 6.5.19.0 (NVD, Adobe Advisory).

The vulnerability is classified as an Information Exposure vulnerability with a CVSS v3.1 Base Score of 5.3 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is associated with CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The attack vector is network-accessible, requires low attack complexity, needs no privileges, and requires no user interaction (NVD).

If exploited, this vulnerability could allow an attacker to achieve a low-confidentiality impact within the application. The vulnerability could potentially expose sensitive information to unauthorized actors, which could be used to further compromise the system or user's privacy (NVD).

The vulnerability requires no user interaction for exploitation and can be accessed through a network vector. There are currently no reports of this vulnerability being exploited in the wild (CIS Advisory).

Adobe has released security updates to address this vulnerability. Organizations are advised to update to the latest version of Adobe Experience Manager. The vulnerability affects versions 6.5.19 and earlier, and users should upgrade to version 6.5.20.0 or later (Adobe Advisory).