EUVD-2026-35763
GHSA-hpmf-43r3-vfhj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
6DescriptionNVD
Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Articles & Coverage 2
AnalysisAI
Stored cross-site scripting in Adobe Experience Manager Forms JEE LTS SP1 and 6.5.24.0 and earlier allows remote unauthenticated attackers to inject malicious JavaScript into vulnerable form fields that executes in victims' browsers when they visit the affected page. The scope-changed CVSS 9.3 reflects that the injected script can pivot beyond the vulnerable component to compromise the victim's authenticated session or account. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
Technical ContextAI
Adobe Experience Manager (AEM) Forms JEE is the Java Enterprise Edition deployment of Adobe's enterprise digital-experience and forms platform, used to author, render, and process interactive PDF and HTML web forms for customer-facing workflows. The CPE cpe:2.3:a:adobe:adobe_experience_manager_forms_jee covers the affected product line. The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input written into a form field is persisted server-side and later rendered to other users' browsers without proper output encoding or sanitization, allowing arbitrary HTML/JavaScript to execute in the victim's authenticated session context.
RemediationAI
Patch available per vendor advisory APSB26-57 at https://helpx.adobe.com/security/products/aem-forms/apsb26-57.html - upgrade AEM Forms JEE to the fixed version listed in that bulletin (exact fixed version is not enumerated in the input data and should be taken from the Adobe advisory). As compensating controls until patching is possible, place the AEM Forms JEE web tier behind a WAF with rules that block HTML/JavaScript metacharacters in form submissions (trade-off: may break forms that legitimately accept rich text), enforce a strict Content-Security-Policy header that disallows inline scripts and restricts script-src to trusted origins (trade-off: may break custom form widgets or analytics), restrict access to form-rendering URLs to authenticated users on a VPN where feasible to reduce the unauthenticated injection surface, and require re-authentication for any administrative or workflow-approval actions to limit what a stolen session can do.
Reflected Cross-Site Scripting in Adobe Experience Manager Forms JEE (LTS SP1 and 6.5.24.0 and earlier) allows remote un
Stored Cross-Site Scripting in Adobe Experience Manager Forms JEE (versions LTS SP1 and 6.5.24.0 and earlier) permits a
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today