Adobe Experience Manager: Stored Cross-Site Scripting in form fields
Summary
Adobe Experience Manager (AEM) contains a stored Cross-Site Scripting vulnerability (CWE-79) in form fields. An attacker with a low-privileged account can store malicious scripts that run in the browser of a victim who opens the affected page. User interaction is required, and the impact is low for confidentiality and integrity, with no impact on availability. Adobe has released fixes in security bulletin APSB26-189.
Affected
- AEM Cloud Service: 2026.10.29023 and earlier
- AEM 6.5: Service Pack 25 and earlier
- AEM 6.5 LTS: Service Pack 3 and earlier
Fixed in
- AEM Cloud Service: 2026.10.29251
- AEM 6.5: Cumulative Hotfix for GRANITE-75052 according to bulletin APSB26-189 (the CVE record names GRANITE-75398; discrepancy unresolved, verify with Adobe)
- AEM 6.5 LTS: Cumulative Hotfix for GRANITE-75052 (SP1 to SP3)
Workaround
- No workaround documented by Adobe.
- General measures, not from Adobe: limit author and contributor accounts to trusted staff and review who can write to form fields.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in this update.
- Not listed in CISA KEV at the time of research.
- No public proof of concept found. EPSS score 0.00371 (secondary source).
Our recommendation
- Patch AEM Cloud Service to 2026.10.29251 or apply the cumulative hotfix for AEM 6.5 and 6.5 LTS as listed in bulletin APSB26-189.
- Confirm the correct hotfix ID for AEM 6.5 with Adobe before deployment.
- Check whether any AEM instance exists in your environment, especially public-facing sites with many authors or external contributors.
- Restrict content-entry rights to trusted users and monitor for unusual script content in form fields.
- Do not confuse this issue with the critical CWE-94 vulnerabilities in the same bulletin.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (CNA: Adobe) www.cve.org
- Adobe security bulletin APSB26-189 www.adobe.com
- OpenCVE (exploitation and KEV status, secondary) app.opencve.io
- HKCERT Adobe monthly security update November 2026 www.hkcert.org
- ZDI November 2026 security update review (secondary) www.thezdi.com
- Strix CVE-2026-123259 (secondary) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:15.
Original description (NVD)
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.