by Kastro
Paper/Archive/CVE-2026-83662

CVE-2026-83662

Adobe Adobe Experience Manager as a Cloud Service — Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)

EPSS 1%CVSS 9.3
critical.is priorityof 100
41
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 63.5.635 × 2012.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Affected

ProductAffectedFixed inSource
Adobe Experience Manager as a Cloud Service≤ 2026.9.281872026.9.28386CNA
Adobe Experience Manager 6.5 LTS≤ 6.5 LTS SP36.5 LTS SP3 - Hotfix for SITES-49893 + SITES-49334 + SITES-48208CNA
Adobe Experience Manager 6.5≤ 6.5.256.5.25 - Hotfix for SITES-49894 + SITES-49335 + SITES-48207CNA

Scores by source

adobe (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryhelpx.adobe.com/security/products/experience-manager/apsb26-152.html