Stored Cross-Site Scripting Vulnerability in Adobe Experience Manager
CVE-2026-118478

5.4MEDIUM

Key Information:

Vendor: Adobe
Status: Adobe Experience Manager As A Cloud Service; Adobe Experience Manager 6.5; Adobe Experience Manager 6.5 Lts
Vendor: CVE Published:; 10 November 2026

What is CVE-2026-118478?

Adobe Experience Manager is susceptible to a stored Cross-Site Scripting (XSS) vulnerability, enabling low-privileged attackers to inject harmful scripts into form fields. Exploiting this flaw can lead to the execution of malicious JavaScript in the browsers of users who access the affected pages, potentially compromising their information and security.

Affected Version(s)

Adobe Experience Manager 6.5 0 <= 6.5.25

Adobe Experience Manager 6.5 LTS 0 <= 6.5 LTS SP3

Adobe Experience Manager as a Cloud Service 0 <= 2026.10.29023

References

https://www.adobe.com/trust/security/products/experience-...

vendor-advisory

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 10, 2026
Vulnerability Reserved
Oct 28, 2026

CVE-2026-118478 Data

JSON