EUVD-2026-22665
GHSA-m4p2-m73g-c9h4
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
Lifecycle Timeline
4DescriptionCVE.org
Adobe Experience Manager versions FP11.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
AnalysisAI
Stored Cross-Site Scripting in Adobe Experience Manager versions FP11.7 and earlier allows authenticated attackers to inject malicious JavaScript into form fields, which executes in victims' browsers with limited impact (confidentiality and integrity). The vulnerability requires user interaction (victim must view the affected page) and authenticated access, resulting in a CVSS 5.4 (medium) score. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
This vulnerability exploits improper input validation and output encoding in Adobe Experience Manager's form field handling, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The affected component fails to sanitize or encode user-supplied data before rendering it in the browser context, allowing attackers with authenticated access to inject arbitrary JavaScript that persists in the application's data store. When other users access pages containing these malicious form fields, their browsers execute the injected scripts in the security context of the AEM application, potentially allowing theft of session tokens, user credentials, or modification of page content.
RemediationAI
Upgrade Adobe Experience Manager to Feature Pack 12 or later, which is the first release series confirmed to address this vulnerability. Organizations unable to upgrade immediately should implement compensatory controls: restrict form field editing to a minimal set of trusted administrative accounts, enable browser-based Content Security Policy (CSP) headers to limit inline script execution, and audit existing form fields for suspicious JavaScript patterns. Refer to Adobe's official security advisory at https://helpx.adobe.com/security/products/aem-screens/apsb26-34.html for patched versions and additional mitigation guidance.
More in Experience Manager
View allSitecore Experience Manager, Platform, and Commerce versions 9.0 through 10.4 contain a Zip Slip vulnerability that allo
Sitecore PowerShell Extensions through version 7.0 allows authenticated users to upload arbitrary files including ASPX w
Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, wh
Adobe Experience Manager versions 6.5.23.0 and earlier contain a deserialization of untrusted data vulnerability that al
Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 through 10.4.1 contain a hardcoded administr
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows r
Multiple Sitecore products allow remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remote
Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability. Rated critical severity (CVSS 9.8
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerabilit
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), S
An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Comme
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today