Adobe Experience Manager CVE-2026-106629

Exploitation requires (1) the attacker to be able to persist a crafted JavaScript payload into one of the affected Adobe Experience Manager form fields, and (2) a victim to subsequently browse to the page that renders that field (UI:R), at which point the script runs in the victim's browser session. Affected deployments are AEM 6.5 LTS up to and including SP3 and AEM 6.5 up to and including 6.5.25; environments on patched versions per APSB26-152 are not exploitable. The primary limiting factors are the required victim interaction (the payload is dormant until the page is viewed) and the likely need for some level of content-submission access to store the payload in the first place, despite the vendor's PR:N rating.

Adobe-assigned CVSS 3.1 score is 9.3 (Critical) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, indicating a network-reachable, low-complexity stored XSS with a scope change and high confidentiality/integrity impact. The high score is driven largely by PR:N combined with the changed scope (code executes in the victim's authenticated browser context, a separate security authority). However, the signal set is thin: no EPSS probability, no CISA KEV listing, and no public exploit code are present in the input, so there is no evidence of active or imminent exploitation. A notable tension exists between the Adobe PR:N rating and the nature of stored XSS in AEM form fields - persisting a malicious payload typically requires some ability to submit or author content, which in many AEM deployments implies at least a low-privileged account rather than a fully anonymous attacker; this should be verified against the specific affected form component. Additionally, UI:R is a real limiting factor: the payload only fires when a victim navigates to the affected page, so this is not a point-and-click wormable flaw. Net assessment: a legitimately high-severity client-side flaw worth prioritizing for AEM operators given the product's enterprise footprint and scope change, but in the absence of EPSS/KEV/POC it reads as a high-CVSS issue without confirmed real-world exploitation rather than an emergency zero-day.

An attacker stores a malicious JavaScript payload in a vulnerable Adobe Experience Manager form field; when an authenticated user (e.g., a content author or administrator) later browses to the page rendering that field, the script executes in their browser under the AEM origin. This can be leveraged to hijack the victim's session or escalate access to their account. No public proof-of-concept exploit is identified in the provided data.