Volerion logoVolerion
Volerion logoVolerion

Adobe Experience Manager Stored Cross-Site Scripting Vulnerability

Vulnerability

A stored cross-site scripting vulnerability has been identified in Adobe Experience Manager (AEM) that allows low-privileged attackers to inject malicious scripts into vulnerable form fields. When a victim views the page containing the affected field, the injected JavaScript could be executed in their browser. This vulnerability is present in multiple AEM products and versions, including AEM Cloud Service releases through 2026.5.0, AEM 6.5 LTS Service Pack 1 and earlier, and AEM 6.5 Service Pack 24 and earlier.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution in the context of the user viewing the affected page.

Remediation

Users are advised to update to Adobe Experience Manager AEM Cloud Service Release 2026.6.0, AEM 6.5 LTS Service Pack 2 - Hotfix for NPR-43972, or AEM 6.5 Service Pack 25 - Hotfix for NPR-43971.

Added: Jul 15, 2026, 5:22 AM
Updated: Jul 15, 2026, 5:22 AM

Vulnerability Rating

Custom Algorithm
spread
3.4
impact
1.7
exploitability
5.2
remediation
7.7
relevance
9.7
threat
0.0
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.