Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
Adobe Experience Manager versions 6.5.23 and earlier allow attackers to inject malicious scripts in user forms
CVE-2026-27235
Summary
A security flaw in Adobe Experience Manager versions 6.5.23 and earlier allows an attacker to inject malicious code into forms on a website. This could allow the attacker to take over a user's browser and potentially steal sensitive information. Update to a newer version of Adobe Experience Manager to fix this issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| adobe | experience_manager | <= 6.5.24 | – |
| adobe | experience_manager | <= 2026.2.0 | – |
| adobe | experience_manager | 6.5 | – |
| adobe | experience_manager | 6.5 | – |
| adobe | experience_manager | <= 6.5.24.0 | – |
Original title
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts ...
Original description
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
nvd CVSS3.1
5.4
Vulnerability type
CWE-79
Cross-site Scripting (XSS)
Published: 11 Mar 2026 · Updated: 13 Mar 2026 · First seen: 11 Mar 2026