CVE-2026-83662 is a critical reflected cross-site scripting flaw in Adobe Experience Manager. According to Adobe, an unauthenticated attacker could use it to gain elevated access to, or control over, a victim's account or session. The attack works only if the victim visits a malicious URL or interacts with a compromised page.
What Is It
CVE-2026-83662 is a reflected Cross-Site Scripting (XSS) vulnerability (CWE-79) in Adobe Experience Manager (AEM). Adobe PSIRT published it on 2026-10-13. The NVD record still has the status "Received."
An attacker can use the flaw to inject malicious scripts into a web page. This could give the attacker elevated access to, or control over, the victim's account or session. For the attack to work, the victim must visit a maliciously crafted URL or interact with a compromised web page. Adobe notes that the scope is changed, meaning the impact can reach beyond the vulnerable component.
Why It Matters
Adobe rates the flaw 9.3 (CRITICAL) under CVSS 3.1, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N:
- Network-reachable, with low attack complexity
- No privileges required by the attacker
- User interaction required, since the victim must follow a link or load a page
- Scope changed, with high impact to confidentiality and integrity and no impact to availability
The sources cited here do not say whether the flaw is being actively exploited. Even so, the lack of required privileges, network reachability and potential for session takeover make this a priority for organizations running AEM on public-facing sites.
What's Vulnerable
According to Adobe's affected-version data:
| Product | Affected | Fixed / Unaffected |
|---|---|---|
| AEM as a Cloud Service | Versions ≤ 2026.9.28187 | 2026.9.28386 |
| AEM 6.5 LTS | Versions ≤ 6.5 LTS SP3 | 6.5 LTS SP3 with Hotfix for SITES-49893 + SITES-49334 + SITES-48208 |
| AEM 6.5 | Versions ≤ 6.5.25 | 6.5.25 with Hotfix for SITES-49894 + SITES-49335 + SITES-48207 |
Patch Status
Adobe has published fixes in security bulletin APSB26-152:
- AEM as a Cloud Service: Make sure environments are on release 2026.9.28386 or later.
- AEM 6.5 LTS: Apply the SP3 hotfix bundle for SITES-49893, SITES-49334 and SITES-48208.
- AEM 6.5: Apply the 6.5.25 hotfix bundle for SITES-49894, SITES-49335 and SITES-48207.
Administrators should review the Adobe bulletin and apply the relevant update or hotfix promptly, especially on internet-facing AEM instances.