CVE-2026-106631: Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs low-privileged access and must be able to submit content through a vulnerable form field. The attack vector is network-based and does not require complex exploitation conditions.
Does successful exploitation require a victim to take action?
Yes. A victim must browse to a page containing the malicious content for the injected JavaScript to execute in their browser.
What is the potential impact beyond the account that submitted the malicious content?
The vulnerability has changed scope, meaning the impact can extend beyond the attacker’s original security authority. Confidentiality and integrity impacts are rated low, while availability impact is not identified.