Riskcovery

CVE-2026-27262

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

State
Published
Severity
5.4 Medium
Published
Mar 11, 2026
Updated
Aug 27, 2026
Reserved
Feb 18, 2026

Read the record on cve.org

Description

Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Scores

CVSSScoreVectorSource
3.15.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Nadobe

Weaknesses

  • CWE-79 Cross-site Scripting (Stored XSS) (CWE-79)

Affected Products

ProductVersions
Adobe Experience Manager as a Cloud ServiceAdobe
  • 2026.1.0 and earlierAffected
  • 2026.2.0Not affected
Adobe Experience Manager 6.5 LTSAdobe
  • SP1 and earlierAffected
  • SP2Not affected
Adobe Experience Manager 6.5Adobe
  • 6.5.23 and earlierAffected
  • 6.5.24Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.