CVE-2018-5006: Adobe Experience Manager SSRF allows sensitive information disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable SSRF with high confidentiality impact and a very high EPSS score, though no confirmed in-the-wild exploitation is recorded.

What it is

Adobe Experience Manager versions 6.4 and earlier contain a server-side request forgery flaw (CWE-918). An unauthenticated remote attacker can make the server issue requests to arbitrary destinations, which Adobe states could lead to sensitive information disclosure. The record does not list specific affected builds beyond "6.4 and earlier."

Impact

An attacker can use the server as a proxy to reach internal or otherwise unreachable resources and read sensitive information returned through the SSRF channel. The CVSS vector rates confidentiality impact as high with no integrity or availability impact.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The description does not identify the specific endpoint or parameter that accepts the attacker-controlled URL.

Exploitation

Not listed in CISA KEV and no public exploit or exploitation tag appears in the references, which are only vendor and third-party advisories. EPSS is high (0.53755, 98.9th percentile), indicating elevated predicted likelihood of exploitation activity.

What to do

• Apply the Adobe security update referenced in advisory apsb18-23 and upgrade Experience Manager beyond 6.4.
• Restrict outbound network access from AEM servers so they cannot reach internal metadata services, admin interfaces or unrelated internal hosts.
• Place AEM behind a reverse proxy or WAF and block requests whose parameters carry external or internal URLs where the application does not require them.
• Audit AEM configurations for features that fetch remote URLs and disable or lock down those not in active use.
• Monitor AEM server logs for outbound connection attempts to unexpected hosts or ports.

Detection

• Review AEM access and error logs for requests containing URL-like parameters pointing at internal addresses, localhost, or cloud metadata endpoints.
• Monitor egress traffic from AEM hosts for connections to internal RFC1918 ranges or unusual external destinations.
• Alert on outbound HTTP requests originating from the AEM process that do not match known integration endpoints.
• Correlate AEM request logs with downstream service logs to spot server-initiated fetches triggered by external clients.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.