Adobe Experience Manager Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Adobe Experience Manager (AEM) that allows low-privileged attackers to inject malicious scripts into vulnerable form fields. This could lead to the execution of malicious JavaScript in the browsers of users who visit the page containing the affected field. The vulnerability is present in multiple AEM products and versions, including AEM Cloud Service releases through 2026.5.0, AEM 6.5 LTS Service Pack 1 and earlier, and AEM 6.5 Service Pack 24 and earlier.

Impact

Exploitation of this vulnerability could result in the execution of arbitrary code in the context of the user’s browser.

Remediation

Users are advised to update to Adobe Experience Manager AEM Cloud Service Release 2026.6.0, AEM 6.5 LTS Service Pack 2 - Hotfix for NPR-43972, or AEM 6.5 Service Pack 25 - Hotfix for NPR-43971.