Adobe Experience Manager 6.5 and 6.5 LTS have a stored cross-site scripting flaw (CVSS 9.3, Critical) that lets attackers plant malicious scripts in vulnerable form fields; Adobe lists hotfix GRANITE-75052 as the fix.
What Is It
CVE-2026-106629 is a stored cross-site scripting (XSS) vulnerability (CWE-79) in Adobe Experience Manager (AEM). An attacker can inject malicious scripts into vulnerable form fields. The injected JavaScript runs in a victim's browser when they open the page that contains the field. According to Adobe, this could give the attacker elevated access to, or control over, the victim's account or session.
Adobe PSIRT reported the issue, and NVD published it on October 13, 2026. The record is currently in "Received" status.
Why It Matters
Adobe rates this flaw 9.3 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. Key points from that rating:
- Network-reachable, low complexity: an attacker can exploit it remotely without special conditions.
- No privileges required: the attacker does not need an account.
- User interaction required: a victim has to browse to the affected page.
- Scope changed: the impact reaches beyond the vulnerable component, and the risk to both confidentiality and integrity is high.
Because the payload is stored, it keeps running for every user who visits the affected page. That includes privileged users, whose sessions are the most valuable to an attacker.
At the time of writing, this CVE is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm any active exploitation.
What's Vulnerable
Per Adobe's affected-product data:
- Adobe Experience Manager 6.5 LTS: all versions up to and including 6.5 LTS SP3
- Adobe Experience Manager 6.5: all versions up to and including 6.5.25
These builds are listed as unaffected:
- 6.5 LTS SP1, SP2, and SP3 with the hotfix for GRANITE-75052
- 6.5.23, 6.5.24, and 6.5.25 with the hotfix for GRANITE-75052
Patch Status
Adobe has published security bulletin APSB26-152 for this issue. Supported AEM 6.5 and 6.5 LTS releases with the GRANITE-75052 hotfix applied are listed as not affected. AEM administrators should check their installed version against the affected ranges above. Then they should apply the GRANITE-75052 hotfix following the guidance in Adobe's bulletin.
CISA has not set any federal remediation deadline or required action, because the CVE is not in the KEV catalog.