Adobe Experience Manager: Stored Cross-Site Scripting in form fields
Summary
Adobe Experience Manager (AEM) 6.5 LTS and AEM 6.5 contain a stored Cross-Site Scripting (XSS) vulnerability in form fields. An attacker without a login can store malicious JavaScript in a vulnerable form field. The script runs in the browser of a victim who opens the page containing that field, which can give the attacker elevated access or control over the victim's account or session. Adobe rates the issue as critical (CVSS 9.3, scope changed).
Affected
- AEM 6.5 LTS: versions 6.5 LTS up to and including 6.5 LTS SP3
- AEM 6.5: versions up to and including 6.5.25
- AEM Cloud Service: Unknown.
Fixed in
- AEM 6.5 LTS: Hotfix GRANITE-75052 for 6.5 LTS SP1, SP2 and SP3 (per CVE record)
- AEM 6.5: Hotfix GRANITE-75052 for 6.5.23, 6.5.24 and 6.5.25 (per CVE record)
- AEM Cloud Service: Unknown. Check Adobe bulletin APSB26-152 for the CVE-2026-106630 entry.
Workaround
Unknown. Adobe has not published a workaround in the sources reviewed. Generic controls such as a web application firewall with XSS rules and HttpOnly/Secure session cookies reduce risk but are not Adobe-issued fixes.
Exploitation
- No known exploitation in the wild.
- No public proof of concept found.
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, not automatable, technical impact total.
Our recommendation
- Confirm whether you run AEM 6.5 LTS, AEM 6.5 or AEM Cloud Service, and whether it is internet-facing.
- Apply hotfix GRANITE-75052 or the vendor's fixed build as listed in APSB26-152, and do not assume a version number.
- Ask your agency or hosting provider for the patch status if AEM is operated externally.
- Until patched, review public forms that accept anonymous input and check stored content for suspicious script entries.
- Patch the whole APSB26-152 bundle, as it also contains other critical issues.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-152 (Trust Center) www.adobe.com
- Adobe Security Bulletin APSB26-152 (helpx) helpx.adobe.com
- Vulners CVE record CVE-2026-106630 vulners.com
- Strix CVE-2026-106630 www.strix.ai
- VulDB CVE-2026-106630 vuldb.com
- HKCERT Adobe security update October 2026 www.hkcert.org
- Zero Day Initiative October 2026 Adobe security update review www.zerodayinitiative.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:14.
Original description (NVD)
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.