CVE-2026-106629: Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Users who browse to a page containing a vulnerable Adobe Experience Manager form field may be exposed, because stored malicious JavaScript executes in the victim's browser.
What does an attacker need to exploit it?
An attacker needs to be able to inject malicious script into a vulnerable form field. The attacker does not need prior privileges, but a victim must browse to the page where the injected content is stored.
Can exploitation affect another user's account or session?
Yes. The malicious script may execute in the victim's browser and could potentially give the attacker elevated access or control over that victim's account or session.