CVE-2018-5006

Exploitation likely. EPSS gives it a 53% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.07.5High EPSS percentile99th53% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2018-07-20Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

n/a Adobe Experience Manager AEM 6.4 and earlierAffected: Adobe Experience Manager AEM 6.4 and earlierUpgrade to: not statedStated by: CVE record
Adobe Experience ManagerAffected: ≤ 6.4.0Upgrade to: after 6.4.0Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your Adobe Experience Manager (AEM) is version 6.4 or earlier.
Apply Adobe’s remediation from security bulletin APSB18-23 (or upgrade to a version that includes the bulletin’s fix).
After updating, verify the AEM service is running normally and that the patched changes are present.
If you cannot patch immediately, restrict network access so the AEM server can’t reach internal addresses from the web-exposed application paths.

Vendor advisory Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Adobe Experience Manager versions 6.4 and earlier have a Server-Side Request Forgery vulnerability. Successful exploitation could lead to sensitive information disclosure.

In plain language

Written by AI from the record

CVE-2018-5006 is a weakness in Adobe Experience Manager (AEM) that can let an attacker trick the server into fetching other internal web resources, which may expose sensitive information. If you run AEM 6.4 or older on a public-facing site, you should act now to upgrade or apply Adobe’s fix.

CVE-2018-5006 is a Server-Side Request Forgery (CWE-918) in Adobe Experience Manager (AEM) 6.4 and earlier, where crafted requests can make the AEM server request other URLs, potentially disclosing sensitive information; no confirmed “exploited in the wild” listing (CISA KEV) was found in the provided sources.

If you're affected

Sensitive data exposure
Internal system data leakage
Compliance and privacy risk

What is it

Think of AEM like a web “front desk” that can also make its own internal requests to other services. With this flaw, a bad actor may be able to trick AEM into requesting the “back door” locations it can reach, and then learn information from the results. The risk is not service downtime, but getting access to sensitive data that should stay internal.

Who is affected

This matters if your small business runs Adobe Experience Manager (AEM) version 6.4 or earlier—especially if it’s accessible from the internet or used for customer-facing content. Because this is server-side request forgery, the practical risk depends on whether an attacker can reach the vulnerable AEM functionality through your network and then cause AEM to make unintended internal requests.

How urgent is it

Treat this as high priority but not “panic immediate”: the issue is serious (sensitive information disclosure is possible) and Adobe has provided a remediation, but there was no confirmation in the provided sources that attackers are actively exploiting it in the wild. Given the rising predicted likelihood, schedule the patch/upgrading work as soon as possible, before your next exposure window.

What to do — in detail

Confirm exposure

Identify your installed AEM version (6.4 or earlier = affected per the vulnerability description).
Confirm whether the AEM instance is reachable from external networks (customer-facing websites, exposed ports, or reverse proxies).

Remediate

Apply Adobe’s fix from the security bulletin APSB18-23 for Adobe Experience Manager.
If you maintain multiple environments (production, staging, testing), patch in this order: staging/test first (to validate), then production.
Validate after upgrade/patch: confirm AEM services start correctly and that normal site functionality works.

If patching is delayed (temporary containment)

Limit outbound network access from the AEM application server so it cannot reach sensitive internal addresses (for example, internal admin panels, metadata endpoints, or internal-only services).
Ensure only required inbound paths are exposed to the internet (reduce the chance attackers can reach the vulnerable functionality).
Add monitoring for unusual outbound requests originating from the AEM server process (spikes in internal URL fetch patterns, repeated errors, or unexpected destination hosts).

What to monitor after patch

Application logs for request patterns related to SSRF-style attempts (unexpected internal target URLs, repeated failures, or redirects).
Network logs for outbound requests from the AEM server to destinations that are normally not contacted.

Due dates

No CISA KEV listing was provided for this CVE in the supplied findings, so no specific “KEV deadline” can be asserted from this dataset.

Technical context

CVE-2018-5006 is a Server-Side Request Forgery (CWE-918) in Adobe Experience Manager (AEM) versions 6.4 and earlier. The core mechanism is that the vulnerable AEM feature can be manipulated so the server makes HTTP requests to attacker-influenced destinations (including potentially internal URLs). Successful exploitation is described as leading to sensitive information disclosure, while availability impact is not highlighted in the provided findings.

From the provided sources: there is no CISA KEV entry and no public exploit code on record, but a predicted likelihood is high and rising (do not treat that prediction as proof of active exploitation). The remediation path referenced by the findings is Adobe’s security bulletin APSB18-23.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

53% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

22 events over 2987 days, from the signal feeds we watch.

2026-09-23EPSS band changemoderate → highepss band change
2026-09-21EPSS band changehigh → moderateepss band change
2026-09-06EPSS band changemoderate → highepss band change
2026-09-05EPSS band changehigh → moderateepss band change
2026-08-31EPSS band changemoderate → highepss band change
2026-08-28EPSS band changehigh → moderateepss band change

Affected products

adobecommercial · USaka adobe systems inc.
- experience managerWeb AppSaaSEnterprise Software / document-mgmt

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact