Adobe Experience Manager: Stored Cross-Site Scripting in form fields
Summary
Adobe Experience Manager 6.5 and 6.5 LTS contain a stored Cross-Site Scripting vulnerability (CVE-2026-106629) in form fields. An attacker who can submit content to a vulnerable field can inject JavaScript that runs in the browser of every user who loads the affected page, which can lead to session takeover or account actions with elevated access. Exploitation requires user interaction, meaning a victim must open the page. NVD rates it 9.3 (critical) with scope changed, but sources disagree on some details, so the Adobe bulletin must be checked.
Affected
- Adobe Experience Manager 6.5 LTS: up to and including 6.5 LTS SP3
- Adobe Experience Manager 6.5: up to and including 6.5.25
- AEM Cloud Service: Unknown.
Fixed in
- Adobe Experience Manager 6.5 LTS SP1, SP2, SP3: Hotfix for GRANITE-75052
- Adobe Experience Manager 6.5.23, 6.5.24, 6.5.25: Hotfix for GRANITE-75052
Workaround
- No vendor workaround known. Apply the Hotfix for GRANITE-75052.
- Interim measures (own advice, not from the vendor): restrict who can submit or edit content in affected forms, review stored form content for script code, and consider a Content Security Policy.
Exploitation
- Not known to be exploited in the wild (Zero Day Initiative lists Exploited: No).
- No public proof-of-concept code found.
- CISA SSVC: Exploitation none, Automatable no.
- Tenable lists no known exploits.
Our recommendation
- Check whether Adobe Experience Manager is in use and which versions and public forms are exposed.
- Apply the Hotfix for GRANITE-75052 as described in Adobe bulletin APSB26-152; prioritise public-facing sites.
- Verify affected versions and scores on the live Adobe bulletin, as sources differ.
- Review stored form content, monitor for script injection, and ask your agency or hosting partner for status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-152 helpx.adobe.com
- Adobe Trust Center APSB26-152 www.adobe.com
- CVE record mirror (Vulners) vulners.com
- Zero Day Initiative October 2026 review www.zerodayinitiative.com
- SentinelOne vulnerability database entry www.sentinelone.com
- Tenable plugin 365771 www.tenable.com
- HKCERT Adobe monthly security update October 2026 www.hkcert.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:14.
Original description (NVD)
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.