CVE-2026-110073: Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs low-privileged access to inject malicious script into a vulnerable form field. Exploitation also requires a victim to browse to the page containing that field.
Who is at risk from a successful exploit?
Users who view a page containing attacker-injected content may have malicious JavaScript executed in their browsers. The changed scope indicates the impact can extend beyond the privileges of the attacker.
How can teams identify possible exposure?
Review vulnerable form fields and pages for unexpected or untrusted JavaScript content, particularly content submitted by low-privileged users. Investigate pages viewed by users where such injected content may have been rendered.