CVE-2026-106633: Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The vulnerability is described as exploitable by a low-privileged attacker. The provided information does not state that anonymous attackers can exploit it.
What causes the malicious script to run?
A victim must browse to a page containing the vulnerable form field where the attacker stored the malicious script. This requires user interaction.
What impact is indicated by the available severity data?
The vector indicates low confidentiality and integrity impact, no availability impact, and changed scope. The listed CVSS severity is medium at 5.4.