CVE-2026-27257: Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-27223
- CVE-2026-27224
- CVE-2026-27225
- CVE-2026-27227
- CVE-2026-27228
- CVE-2026-27229
- CVE-2026-27230
- CVE-2026-27231
- CVE-2026-27232
- CVE-2026-27233
- CVE-2026-27234
- CVE-2026-27235
- CVE-2026-27236
- CVE-2026-27237
- CVE-2026-27239
- CVE-2026-27240
- CVE-2026-27241
- CVE-2026-27242
- CVE-2026-27244
- CVE-2026-27247
- CVE-2026-27248
- CVE-2026-27249
- CVE-2026-27250
- CVE-2026-27251
- CVE-2026-27252
- CVE-2026-27253
- CVE-2026-27254
- CVE-2026-27255
- CVE-2026-27256
- CVE-2026-27262
- CVE-2026-27265
- CVE-2026-27266
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs low-privileged access to Adobe Experience Manager and must be able to submit malicious script content into a vulnerable form field. Exploitation also requires a victim to browse to the page where that stored content is rendered.
What is the likely impact on users who view malicious content?
Malicious JavaScript can execute in the viewing user’s browser. The stated impact includes limited confidentiality and integrity effects, and the scope may extend beyond the vulnerable component.
Which deployments should be investigated?
Adobe Experience Manager 6.5.23 and earlier should be assessed, particularly instances where low-privileged users can enter content through form fields that other users later view.