Advisory · CVE-2026-106629
Stored cross-site scripting in Adobe Experience Manager
Adobe Experience Manager has a stored script injection flaw: an attacker's JavaScript can be saved and later run in a victim's browser with changed scope. Adobe rates it CVSS 3.1 9.3.
- Vendor
- Adobe
- Product
- Adobe Experience Manager
- Identifier / CWE
- CVE-2026-106629
CWE-79 - Action timing
- Immediate
Explain it like I’m five
Content an attacker saves in AEM can carry script that waits quietly until an editor or visitor opens the page.
- 01Script stored
An attacker saves content containing malicious JavaScript in AEM.
- 02Victim opens the page
An editor, administrator, or visitor views the affected page.
- 03Script runs
The script executes in the victim's browser with their session.
What happened
Adobe disclosed CVE-2026-106629 in bulletin APSB26-152 as a stored cross-site scripting vulnerability (CWE-79) in Adobe Experience Manager.
Adobe’s bulletin APSB26-152 covers Experience Manager 6.5 release lines and their hotfixes. Apply the hotfix Adobe lists for your exact 6.5 version rather than assuming one package fits all.
What to do
- Inventory every Adobe Experience Manager deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Adobe Experience Manager while remediation is underway, especially for internet-facing instances.
- Review application and server logs for recently saved content containing script markup and editor reports of strange page behavior.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Stored XSS in the authoring platform targets the people who run your sites. Hotfix and sweep recently saved content.