Advisory · CVE-2026-106630
Second stored cross-site scripting flaw in Adobe Experience Manager
Adobe Experience Manager has a second stored script injection flaw in the same bulletin, also rated 9.3 with changed scope. Adobe rates it CVSS 3.1 9.3.
- Vendor
- Adobe
- Product
- Adobe Experience Manager
- Identifier / CWE
- CVE-2026-106630
CWE-79 - Action timing
- Immediate
Explain it like I’m five
A second stored-content trap in the same product: script saved once, executed for every viewer who follows.
- 01Script stored
An attacker stores malicious JavaScript through the vulnerable function.
- 02Victim opens the page
A user views the affected page or component.
- 03Script runs
The script executes in the victim's browser context.
What happened
Adobe disclosed CVE-2026-106630 in bulletin APSB26-152 as a stored cross-site scripting vulnerability (CWE-79) in Adobe Experience Manager, distinct from CVE-2026-106629 in the same bulletin.
Adobe’s bulletin APSB26-152 covers Experience Manager 6.5 release lines and their hotfixes. Apply the hotfix Adobe lists for your exact 6.5 version rather than assuming one package fits all.
What to do
- Inventory every Adobe Experience Manager deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Adobe Experience Manager while remediation is underway, especially for internet-facing instances.
- Review application and server logs for stored content with script markup, especially content added by new or low-privilege authors.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Two stored XSS flaws, one hotfix. Apply APSB26-152 and review authoring accounts.