CVE-2026-83662
9.3CriticalPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-79
Impact
Attackers can hijack user sessions and run arbitrary scripts in victims' browsers with elevated privileges. They need network access to the instance and must trick an authenticated user into clicking a crafted URL.
Root cause
Adobe Experience Manager fails to properly sanitize user-supplied input before reflecting it back in HTTP responses (reflected XSS).
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Fix & remediation
Upgrade Adobe Experience Manager to the patched version referenced in security bulletin APSB26-152. If patching immediately is impossible, block malicious query parameters and enforce a strict Content Security Policy (CSP) at your web application firewall or reverse proxy.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.