Key points
- Adobe Experience Manager 6.5 LTS and 6.5 are affected by CVE-2026-106629.
- The vulnerability is rated Critical with a CVSS score of 9.3.
- No patch or fix has been confirmed by the vendor yet.
Adobe has identified a critical stored cross-site scripting vulnerability in Adobe Experience Manager 6.5. The flaw, tracked as CVE-2026-106629, affects versions up to 6.5.25 and 6.5 LTS SP3.
What happened
According to the National Vulnerability Database, Adobe Experience Manager is affected by a stored cross-site scripting vulnerability. The issue is classified under CWE-79 and carries a CVSS score of 9.3, which is rated as Critical. The source material notes that the scope of the vulnerability is changed.
The vulnerability could be abused by an attacker to inject malicious scripts into vulnerable form fields. These scripts may be executed in a victim's browser when they browse to the page containing the vulnerable field. This execution could potentially lead to gaining elevated access or control over the victim's account or session.
Why it matters
Malicious JavaScript may be executed in the victim's browser upon viewing the affected page. This could result in the attacker gaining elevated access or control over the victim's account or session. The potential for account takeover makes this a significant risk for organisations using the affected software.
Security operations teams must consider the exposure of form fields that accept user input. If these fields are accessible to users who might be targeted, the risk of session hijacking increases. The critical severity rating underscores the importance of addressing this issue promptly.
What happens next
- Review all Adobe Experience Manager 6.5 and 6.5 LTS installations for version compliance.
- Identify forms and input fields that may be susceptible to stored script injection.
- Monitor logs for unusual JavaScript execution or session anomalies indicative of compromise.
- Await official guidance or patches from Adobe to remediate the vulnerability effectively.
Patch priority
Teams should prioritise systems with public-facing forms or user-generated content areas. Update these environments first to minimise exposure to external attackers. Before applying any changes, ensure comprehensive backups are in place. Test updates in a non-production environment to verify stability. If no fix is available, restrict access to vulnerable forms and monitor for suspicious activity closely.
What to do and how to stay safe: Adobe
- Audit your Adobe Experience Manager versions to confirm if you are running 6.5 up to 6.5.25 or 6.5 LTS up to SP3.
- Restrict write access to form fields and content areas that could store malicious scripts until a fix is available.
- Monitor server logs and browser console errors for signs of unexpected JavaScript execution or session manipulation.
- Once the vendor provides an update, apply the patch immediately to affected systems and verify the fix.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Adobe Experience Manager are affected by CVE-2026-106629?
Adobe Experience Manager 6.5 up to 6.5.25 and Adobe Experience Manager 6.5 LTS up to 6.5 LTS SP3 are affected.
Is there a patch available for this vulnerability?
No, the source material does not state that a patch or fix has been released by Adobe.
What is the CVSS score for CVE-2026-106629?
The vulnerability has a CVSS score of 9.3, which is rated as Critical.
