CVE-2026-83662: Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require an attacker to authenticate or have existing privileges in Adobe Experience Manager?
No. The vulnerability is rated with network attack vector, low attack complexity, and no required privileges, indicating an attacker can attempt exploitation remotely without prior authentication.
What user action is required for exploitation?
A victim must visit a maliciously crafted URL or interact with a compromised web page. This user interaction requirement means exposure is concentrated among users who can be persuaded to open attacker-controlled content.