Key points
- The vulnerability is rated Critical with a CVSS score of 9.3.
- It affects Adobe Experience Manager 6.5 LTS up to SP3 and 6.5 up to 6.5.25.
- Attackers can inject malicious scripts into form fields to compromise accounts.
Adobe Experience Manager users face a critical stored cross-site scripting vulnerability that enables attackers to inject malicious code into form fields. According to the National Vulnerability Database, this flaw allows adversaries to execute JavaScript in victim browsers, potentially seizing control of user sessions or escalating privileges within the application.
The issue impacts Adobe Experience Manager 6.5 LTS versions up to Service Pack 3 and standard 6.5 releases up to version 6.5.25. The vulnerability carries a CVSS score of 9.3, classified as Critical. The National Vulnerability Database identifies the weakness as CWE-79, noting that the scope of the attack changes, which facilitates account takeover and session hijacking when victims visit pages containing the vulnerable fields.
What we know
The National Vulnerability Database records that the flaw allows attackers to abuse stored cross-site scripting mechanisms. When a user browses to a page with the compromised form field, the malicious JavaScript executes in their browser. This execution can lead to elevated access or full control over the victim's account and session. The vulnerability applies to specific legacy and current maintenance branches of the Adobe Experience Manager 6.5 line.
Defender's checklist
- Verify if your environment runs AEM 6.5 LTS SP3 or older.
- Check if your environment runs AEM 6.5.25 or older.
- Confirm that no unauthorized scripts are stored in form fields.
- Monitor browser console logs for unexpected JavaScript execution.
What analysts watch for
Teams usually examine stored data inputs for unexpected script tags or event handlers. Analysts check whether the application properly sanitizes user-submitted content before rendering it in the browser. They look for persistence mechanisms where malicious code remains on the server until a victim views the page. Investigators also monitor for session token theft or unusual privilege escalation patterns following page visits.
Background: Account takeover
Account takeover occurs when an attacker gains unauthorized access to a user’s digital identity. This happens through stolen credentials, session hijacking, or authentication flaws. The attacker controls the account, accessing data and performing actions as the legitimate user, often bypassing traditional perimeter security measures entirely.
Read the full guide: Account Takeover: Definition, Vectors, and Defense Strategies
What to do and how to stay safe: Adobe
- Update Adobe Experience Manager 6.5 LTS to a version newer than SP3.
- Upgrade Adobe Experience Manager 6.5 to a version newer than 6.5.25.
- Audit form fields for any stored JavaScript or HTML injection attempts.
- Review server logs for unusual access patterns or session anomalies.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-106629?
The National Vulnerability Database rates the vulnerability as Critical with a CVSS score of 9.3.
Which versions of Adobe Experience Manager are affected?
The flaw affects AEM 6.5 LTS up to SP3 and AEM 6.5 up to version 6.5.25.
What type of vulnerability is CVE-2026-106629?
It is a stored cross-site scripting (XSS) vulnerability classified as CWE-79.
