IT SBIT Services
Schneeberger
DEEN
CVE tracker

Adobe Experience Manager: Reflected Cross-Site Scripting (XSS)

CVE-2026-83662Critical 9.3

← All vulnerabilities

Summary

Adobe Experience Manager (AEM) contains a reflected Cross-Site Scripting vulnerability, tracked as CVE-2026-83662 and rated CRITICAL (CVSS 9.3) in the CVE record. The CVE record describes injected scripts that run in a victim's browser after the victim opens a crafted URL or interacts with a compromised page, which could expose the victim's account or session. Adobe's bulletin APSB26-152 lists this CVE as SQL injection (CWE-89), a security feature bypass, with CVSS 7.1 and no user interaction, so the vulnerability type and severity must be verified in the advisory before they are relied upon. AEM is an enterprise platform, so the impact on SMEs is likely limited to organisations that run it.

Affected

  • Adobe Experience Manager as a Cloud Service: 2026.9.28187 and earlier
  • Adobe Experience Manager 6.5 LTS: 6.5 LTS SP3 and earlier
  • Adobe Experience Manager 6.5: 6.5.25 and earlier

Fixed in

  • Adobe Experience Manager as a Cloud Service: 2026.9.28386
  • Adobe Experience Manager 6.5 LTS: hotfix for SITES-49893, SITES-49334 and SITES-48208 per the CVE record; the research notes cite hotfix GRANITE-71772 from the bulletin. The mapping to this CVE is not confirmed.
  • Adobe Experience Manager 6.5: hotfix for SITES-49894, SITES-49335 and SITES-48207 per the CVE record. Confirm the correct hotfix in the advisory download links.

Workaround

Unknown. No vendor-documented workaround was found. Applying the fix is the only confirmed remediation.

Exploitation

  • No evidence of exploitation in the wild was found.
  • The ZDI October 2026 review lists the APSB26-152 bundle as not exploited.
  • The vulnerability is not in CISA KEV (per Rapid7). EPSS is about 1%.
  • CISA SSVC: exploitation none, not automatable, total technical impact.
  • No public proof of concept was found. This is not exhaustive.

Our recommendation

  • Read advisory APSB26-152 and confirm the CWE, CVSS vector and affected component for CVE-2026-83662.
  • Inventory all AEM instances (Cloud Service, 6.5 and 6.5 LTS) and record their versions.
  • Apply 2026.9.28386 for Cloud Service, or the correct hotfix for 6.5 and 6.5 LTS, then verify the result.
  • Check whether any AEM endpoints are reachable from the internet and treat public instances as high priority.
  • Monitor for unusual requests to AEM URLs and for signs of session misuse.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:12.

Original description (NVD)

Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed