Adobe Experience Manager CVE-2026-109415

Exploitation requires an authenticated low-privileged account (PR:L) with the ability to write content into an affected AEM form field - i.e., a content author/form-contributor role on an AEM Sites/Forms authoring instance (6.5 LTS through SP3, or 6.5 through 6.5.25). Execution is gated by victim user interaction (UI:R): a separate user must browse to the page that renders the injected field before the stored JavaScript fires. These two factors - the need for an existing authoring account and a victim visit - are the primary limiters; the flaw is not exploitable by anonymous external users and does not affect default read-only visitor paths.

This is a moderate-severity stored XSS (CVSS 5.4) that should be treated as a medium priority rather than an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) shows a network-reachable, low-complexity flaw but with two meaningful brakes: it requires low-privileged authentication (PR:L) and victim interaction (UI:R), meaning an attacker must already have an authoring/form-contributor account and must wait for a victim to visit the poisoned page. The changed scope (S:C) and low-but-dual C:L/I:L impacts correctly reflect that injected script executes in the victim's browser context, potentially crossing a trust boundary (e.g., stealing an admin session on the AEM authoring domain). No EPSS score was provided, there is no CISA KEV listing, and no public POC is referenced - so there is no evidence of active exploitation or weaponization. Net: a real but not critical issue; prioritize behind unauthenticated RCE/KEV items but patch in a normal cycle because AEM authoring environments often grant many low-privileged content contributors, enlarging the pool of potential inside attackers.

A low-privileged AEM content author injects malicious JavaScript into a vulnerable form field. When a higher-privileged user (such as an administrator or reviewer) later browses to the page rendering that field, the script executes in their authenticated browser session, enabling session token theft or actions performed as the victim. No public exploit code is referenced, so exploitation would require an attacker to craft the payload themselves.