Adobe AEM 6.5 Stored XSS Flaw Rated 9.3 Critical Risk

Adobe Experience Manager 6.5 contains a critical stored cross-site scripting vulnerability that enables attackers to hijack user sessions and take over accounts, according to the National Vulnerability Database. This flaw, identified as CVE-2026-106630, allows malicious scripts to be injected into vulnerable form fields within the application. When a victim visits a page containing these compromised fields, the browser executes the injected JavaScript code. This execution can grant the attacker elevated access or full control over the victim's account and session data.

The risk

The National Vulnerability Database rates CVE-2026-106630 with a CVSS score of 9.3, marking it as a critical severity issue. The flaw falls under CWE-79, which covers improper neutralization of input during page generation. The vulnerability description notes that the scope of the impact is changed, indicating that the data generated by the vulnerable component can affect other components. Attackers exploit this by placing malicious scripts in form fields that are stored by the application and later served to other users.

Who is exposed

Organizations running specific versions of Adobe Experience Manager are directly exposed to this threat. The affected software includes Adobe Experience Manager 6.5 up to version 6.5.25. Additionally, the long-term support branch is vulnerable, specifically Adobe Experience Manager 6.5 LTS up to Service Pack 3. Any user accessing pages with the vulnerable form fields on these versions risks having their session hijacked or their account compromised by an attacker executing the injected scripts.

Cost and compliance

The source material does not provide details regarding financial costs, regulatory compliance impacts, or specific legal liabilities associated with CVE-2026-106630. The National Vulnerability Database record focuses solely on the technical nature of the vulnerability, its severity rating, and the affected software versions. No information is provided about potential data breach fines, remediation costs, or industry-specific compliance frameworks that might be triggered by this account takeover capability.

What should you do?

Teams managing Adobe Experience Manager 6.5 environments should immediately verify their current version against the affected list. If running version 6.5.25 or lower, or 6.5 LTS SP3 or lower, prioritize checking for vendor updates. Monitor user sessions for unusual activity that might indicate script execution or unauthorized access. Until a patch is confirmed, restrict access to forms that accept untrusted input to reduce the attack surface.

The background in plain language

Stored cross-site scripting occurs when an application saves user input without properly sanitizing it. Later, when other users view that saved content, their browsers execute the hidden code. This differs from reflected XSS, where the script is only in the immediate response. For teams, this means checking input validation on all forms. Ensure that data displayed to users is encoded correctly. Regularly audit third-party components for known input handling flaws. This guidance helps prevent script injection regardless of the specific software vendor or version involved.

What to do and how to stay safe: Adobe Experience Manager

• Verify if your Adobe Experience Manager instance is version 6.5 up to 6.5.25 or 6.5 LTS up to SP3.
• Monitor server logs and user sessions for signs of unauthorized script execution or account takeover attempts.
• Restrict access to vulnerable form fields to trusted administrators until a vendor update is available.
• Review input validation policies to ensure all user-submitted data is properly sanitized before storage and display.

Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific versions of Adobe Experience Manager are affected by CVE-2026-106630?

Adobe Experience Manager 6.5 up to 6.5.25 and Adobe Experience Manager 6.5 LTS up to 6.5 LTS SP3 are affected.

What is the severity rating of this vulnerability?

The National Vulnerability Database assigns CVE-2026-106630 a CVSS score of 9.3, which is classified as critical.

How can an attacker exploit this stored XSS flaw?

Attackers inject malicious JavaScript into vulnerable form fields, which executes in a victim's browser when they view the page, potentially hijacking sessions.