Adobe Experience Manager Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Adobe Experience Manager (AEM) versions 6.5.23 and earlier. This vulnerability allows low-privileged attackers to inject malicious scripts into vulnerable form fields. When a victim views the page containing the affected field, the injected JavaScript could be executed in their browser.

Impact

Exploitation of this vulnerability allows for arbitrary code execution in the context of the victim's browser.

Remediation

Users are advised to update to Adobe Experience Manager 6.5 LTS Service Pack 2, 6.5 Service Pack 24, or AEM Cloud Service Release 2026.02. For assistance with AEM versions 6.4, 6.3, and 6.2, please contact Adobe customer care.