Stored Cross-Site Scripting Vulnerability in Adobe Experience Manager
CVE-2026-123259

5.4MEDIUM

Key Information:

Vendor: Adobe
Status: Adobe Experience Manager As A Cloud Service; Adobe Experience Manager 6.5; Adobe Experience Manager 6.5 Lts
Vendor: CVE Published:; 10 November 2026

What is CVE-2026-123259?

Adobe Experience Manager contains a stored Cross-Site Scripting (XSS) vulnerability, allowing low-privileged attackers to inject malicious scripts into vulnerable form fields. When victims interact with these compromised fields, harmful JavaScript may execute in their browsers, potentially leading to unauthorized actions or data exposure.

Affected Version(s)

Adobe Experience Manager 6.5 0 <= 6.5.25

Adobe Experience Manager 6.5 LTS 0 <= 6.5 LTS SP3

Adobe Experience Manager as a Cloud Service 0 <= 2026.10.29023

References

https://www.adobe.com/trust/security/products/experience-...

vendor-advisory

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 10, 2026
Vulnerability Reserved
Nov 5, 2026

CVE-2026-123259 Data

JSON