CVE-2026-106630
9.3CriticalPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-79
Impact
Attackers can hijack user sessions and run arbitrary scripts in victims' browsers with elevated access. Exploitation requires injecting malicious input into vulnerable form fields and convincing a victim to view the affected page.
Root cause
Improper input sanitization and output encoding allow persistent malicious scripts to be stored in form fields and rendered directly to other users.
Affected systems
Adobe Experience Manager (specific affected versions not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Fix & remediation
Upgrade Adobe Experience Manager to the fixed version specified in security bulletin apsb26-152; if patching immediately is not feasible, restrict untrusted user input on form fields or place a Web Application Firewall in front of the instance to block stored XSS payloads.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.