Reflected Cross-Site Scripting Vulnerability in Adobe Experience Manager
CVE-2026-123341

5.4MEDIUM

Key Information:

Vendor

Adobe
Status
Adobe Experience Manager As A Cloud Service
Vendor
CVE Published:
10 November 2026

What is CVE-2026-123341?

Adobe Experience Manager is vulnerable to a reflected Cross-Site Scripting (XSS) attack. An attacker with low privileges could exploit this flaw by enticing a user to visit a specially crafted URL. Upon accessing the compromised link, malicious JavaScript code could execute within the browser of the victim, leading to potential unauthorized actions or data exposure. This vulnerability underscores the importance of validation and sanitization of user inputs within web applications.

Affected Version(s)

Adobe Experience Manager as a Cloud Service 0 < 2026.10.28871

Adobe Experience Manager as a Cloud Service 2026.10.28871

References

https://www.adobe.com/trust/security/products/experience-...
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.