Adobe has disclosed a stored cross-site scripting flaw in Adobe Experience Manager (AEM) 6.5 and 6.5 LTS, rated CVSS 9.3 (Critical), that lets attackers plant malicious JavaScript in vulnerable form fields.
What Is It
CVE-2026-106630 is a stored cross-site scripting (XSS) vulnerability, classified as CWE-79, in Adobe Experience Manager. Adobe says an attacker can inject malicious scripts into vulnerable form fields. The script then runs in a victim's browser when that person opens the page containing the field. Adobe says this could give the attacker elevated access to, or control over, the victim's account or session. Adobe also notes that "scope is changed," which means the impact can reach beyond the vulnerable component itself.
Adobe PSIRT published the CVE on October 13, 2026. Its NVD status is currently "Received."
Why It Matters
Adobe scores this flaw CVSS 3.1 9.3 (Critical), with the vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N:
- Network-reachable, low complexity: an attacker can reach it remotely without special conditions.
- No privileges required: the attacker does not need an account.
- User interaction required: a victim has to browse to the affected page.
- High confidentiality and integrity impact, with changed scope: a successful attack can expose data and allow actions in the victim's session.
Because the XSS is stored, one injected payload can hit every user who later views the page. If that includes authors or administrators, the risk to a content platform is higher.
Exploitation status: CVE-2026-106630 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation.
What's Vulnerable
According to Adobe's affected-product data:
- Adobe Experience Manager 6.5 LTS: versions up to and including 6.5 LTS SP3
- Adobe Experience Manager 6.5: versions up to and including 6.5.25
Patch Status
Adobe lists the following builds as unaffected once the hotfix for GRANITE-75052 is applied:
- AEM 6.5 LTS SP1, SP2, and SP3 with the GRANITE-75052 hotfix
- AEM 6.5.23, 6.5.24, and 6.5.25 with the GRANITE-75052 hotfix
Administrators should check Adobe security bulletin APSB26-152 and apply the GRANITE-75052 hotfix to their AEM version. Because there is no KEV entry, CISA has not issued a required action or due date.