CVSS 9.3: AEM 6.5 Stored XSS Enables Session Hijacking and Privilege Escalation

Adobe Experience Manager contains a stored cross-site scripting flaw that poses a severe risk to organizations relying on the platform for content management. The National Vulnerability Database lists the issue as CVE-2026-106629 with a Critical severity rating of 9.3. This vulnerability allows attackers to inject malicious scripts into specific form fields within the application.

When a user visits a page containing the vulnerable field, their browser executes the injected JavaScript. This execution can lead to significant security breaches, including the theft of session tokens or the escalation of user privileges. The flaw effectively allows an attacker to gain elevated access or full control over a victim's account within the system.

Technical context

The weakness is classified under CWE-79, which relates to improper neutralization of input during web page generation. The NVD record notes that the scope of the vulnerability is changed, indicating that the impact extends beyond the origin of the request. This means data from one user can affect another, increasing the potential for account takeover scenarios across the organization's digital infrastructure.

Affected versions

The vulnerability impacts specific releases of Adobe Experience Manager 6.5. Affected versions include Adobe Experience Manager 6.5 LTS up to Service Pack 3. Additionally, standard releases of Adobe Experience Manager 6.5 up to version 6.5.25 are vulnerable. Organizations running any of these versions are exposed to the risk of stored cross-site scripting attacks unless mitigation measures are in place.

Defender's checklist

Security teams should immediately inventory all systems running the affected versions of Adobe Experience Manager. Verify whether any public-facing forms or internal content pages are using the vulnerable components. Monitor browser console logs for unexpected JavaScript execution that does not originate from known sources. Coordinate with development teams to assess if custom scripts interact with the affected form fields in ways that could amplify the impact of an injection.

Operational impact

Organizations should immediately review their incident response plans for potential account compromise scenarios. IT leaders need to coordinate with legal and compliance teams to assess data privacy implications if user sessions were hijacked. Suppliers providing AEM maintenance should be contacted to confirm their support status for the affected versions. Internal communications teams must prepare to notify users about potential session invalidation procedures. Managers should ensure that all stakeholders understand the risk of privilege escalation and the need for heightened monitoring of administrative actions within the platform.

Background: Privilege escalation vulnerabilities

Privilege escalation vulnerabilities allow attackers to gain unauthorized access to higher-level system permissions. These flaws bypass security controls by exploiting misconfigurations or unpatched software. You must enforce least privilege and audit permissions regularly to prevent attackers from moving laterally and taking control of your critical assets.

Read the full guide: Privilege Escalation Vulnerabilities: How Attackers Steal Admin Control

What to do and how to stay safe: Adobe Experience Manager

• Audit your environment to identify any instances of Adobe Experience Manager 6.5 running versions up to 6.5.25 or 6.5 LTS SP3.
• Implement web application firewall rules to block common cross-site scripting payloads in form submissions until a patch is available.
• Monitor server logs and browser console outputs for signs of unauthorized JavaScript execution or unusual user session behavior.
• Once the vendor provides an update, prioritize applying the patch to all affected systems to eliminate the stored XSS vector.

Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction

General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-106629?

The National Vulnerability Database assigns a CVSS score of 9.3, rating the vulnerability as Critical.

Which versions of Adobe Experience Manager are affected?

Adobe Experience Manager 6.5 LTS up to SP3 and Adobe Experience Manager 6.5 up to 6.5.25 are affected.

How can an attacker exploit this vulnerability?

Attackers can inject malicious scripts into vulnerable form fields, which execute in a victim's browser when they view the page.