CVE-2026-106630: Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users who browse to a page containing a vulnerable form field with attacker-injected content may have malicious JavaScript executed in their browser. The resulting impact can include elevated access to, or control over, the victim's account or session.
What does an attacker need to trigger the issue?
The attacker needs to inject malicious script into vulnerable form fields. Exploitation then requires a victim to browse to the page that contains the affected field.