Advisory · CVE-2026-83662
Reflected cross-site scripting in Adobe Experience Manager
Adobe Experience Manager has a reflected script injection flaw: an attacker can craft input that AEM reflects into a page so script runs in a victim's browser. Adobe rates it CVSS 3.1 9.3.
- Vendor
- Adobe
- Product
- Adobe Experience Manager
- Identifier / CWE
- CVE-2026-83662
CWE-79 - Action timing
- Immediate
Explain it like I’m five
AEM echoes attacker input straight back into a web page, so a crafted link becomes a script delivery vehicle for whoever opens it.
- 01Crafted link or request
An attacker builds a request containing malicious script.
- 02Victim opens it
A user follows the link or submits the request.
- 03Script reflected and runs
AEM returns the script in its response and it executes in the victim's browser.
What happened
Adobe disclosed CVE-2026-83662 in bulletin APSB26-152 as a reflected cross-site scripting vulnerability (CWE-79) in Adobe Experience Manager.
Adobe’s bulletin APSB26-152 covers Experience Manager 6.5 release lines and their hotfixes. Apply the hotfix Adobe lists for your exact 6.5 version rather than assuming one package fits all.
What to do
- Inventory every Adobe Experience Manager deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Adobe Experience Manager while remediation is underway, especially for internet-facing instances.
- Review application and server logs for URLs containing script markup in AEM access logs and user reports of suspicious links.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Reflected XSS is a phishing amplifier aimed at your own editors and customers. Hotfix and check logs for crafted links in circulation.