Adobe Experience Manager CVE-2026-106631

Exploitation requires the attacker to hold a low-privileged authenticated account on Adobe Experience Manager with the ability to submit content into the affected form fields (consistent with PR:L), and a victim must subsequently navigate to the page rendering the stored payload (UI:R) for the script to execute. Limiting factors: no anonymous/unauthenticated path (authoring access is required), dependency on victim browsing action, and restriction to AEM 6.5 (≤6.5.25) and 6.5 LTS (≤SP3). Impact is amplified where many or untrusted users have authoring rights, or where low-privileged authors can target higher-privileged reviewers/administrators who open the affected pages.

This is a moderate-severity stored XSS (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) in Adobe Experience Manager with no signals of elevated real-world urgency. The network attack vector and low complexity are offset by two meaningful constraints: the attacker must already hold low-level privileges (PR:L) to reach and inject into the vulnerable form fields, and a victim must then browse to the affected page (UI:R), so exploitation is not fully unauthenticated or self-propagating. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so there is no evidence of active exploitation or automatable mass exploitation - this is reported by Adobe PSIRT as a vendor-disclosed issue rather than an observed in-the-wild threat. The scope change (S:C) and the ability to run script in a victim's authenticated browser session are the main risk drivers, since a low-privileged author could escalate impact by targeting higher-privileged users (e.g. reviewers or administrators who open the page). Net assessment: a real but non-emergency priority - patch in a normal cycle, prioritizing internet-facing author/publish instances with untrusted or many content contributors. No conflicting signals were detected; the main gap is the absence of EPSS/KEV/POC data, which prevents a data-driven exploitation-likelihood estimate.

A low-privileged content author with access to an AEM authoring form injects a malicious JavaScript payload into a vulnerable form field, which is stored and later rendered. When a higher-privileged user (such as a reviewer or administrator) browses to the page containing that field, the script executes in their authenticated browser session, enabling session/token theft or actions performed as that victim. No public exploit code was identified at time of analysis, and exploitation requires the attacker to already hold authoring privileges plus victim interaction.