by Kastro
Paper/Archive/CVE-2026-106629

CVE-2026-106629

Adobe Adobe Experience Manager 6.5 LTS — Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

EPSS 0.9%CVSS 9.3
critical.is priorityof 100
40
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 58.8.588 × 2011.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

Affected

ProductAffectedFixed inSource
Adobe Experience Manager 6.5 LTS≤ 6.5 LTS SP36.5 LTS SP1 - Hotfix for GRANITE-75052, 6.5 LTS SP2 - Hotfix for GRANITE-75052, 6.5 LTS SP3 - Hotfix for GRANITE-75052CNA
Adobe Experience Manager 6.5≤ 6.5.256.5.23 - Hotfix for GRANITE-75052, 6.5.24 - Hotfix for GRANITE-75052, 6.5.25 - Hotfix for GRANITE-75052CNA

Scores by source

adobe (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryhelpx.adobe.com/security/products/experience-manager/apsb26-152.html