CVE-2026-106629
9.3CriticalPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-79
Impact
Attackers can hijack user sessions and run arbitrary scripts in the context of victim accounts, including administrators. An unauthenticated attacker injects malicious input into form fields, which then executes when a user browses the affected page.
Root cause
Improper input sanitization and output encoding allow persistent, stored malicious scripts within form fields.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Fix & remediation
Apply the official patch specified in Adobe security bulletin APSB26-152; if patching must wait, restrict access to the affected form fields and enforce strict Content Security Policy (CSP) headers to block unauthorized script execution.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.