Executive brief
Adobe Experience Manager, a widely used content management system for enterprises, contains a stored cross-site scripting (XSS) vulnerability in form fields that allows low-privileged users to inject malicious scripts. When other users—including administrators—view pages containing the compromised form fields, the injected scripts execute in their browsers, potentially allowing attackers to steal session tokens, modify page content, or redirect users to malicious sites.
Technical details
The vulnerability is a stored XSS flaw in Adobe Experience Manager's form field handling. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields; unlike reflected XSS, the payload persists in the application's database and executes whenever any user (including higher-privileged accounts) accesses the affected page. The attack requires the attacker to have create/edit permissions on forms, and the malicious script runs in the context of the victim's browser with their authentication token. The scope change indicates the vulnerability can impact assets or data beyond the vulnerable component itself. Adobe has released patches (APSB26-98) to address this issue.
Affected products
- Adobe Experience Manager
Timeline
- 2026-09-08: disclosed