How Does Critical Stored XSS in AEM 6.5 Threaten User Sessions and Privileges?

The short version

• A stored Cross-Site Scripting vulnerability exists in older Adobe Experience Manager releases.
• Successful exploitation allows attackers to inject scripts that run when victims view affected pages.
• This could lead to session hijacking or elevated access within the victim's account.

The details

The National Vulnerability Database records CVE-2026-106629 as a critical severity issue affecting Adobe Experience Manager. The flaw stems from CWE-79, allowing stored cross-site scripting. Attackers can inject malicious JavaScript into specific form fields within the application. When a victim navigates to the page containing the compromised field, the browser executes the script.

This execution may grant the attacker control over the victim's session or elevated access rights. The scope of the vulnerability is noted as changed. Affected versions include Adobe Experience Manager 6.5 LTS up to Service Pack 3. Additionally, versions of Adobe Experience Manager 6.5 up to 6.5.25 are listed as vulnerable. No other version ranges are specified in the record.

The context

This vulnerability mirrors previous issues found in Adobe's commerce platforms. As Honeypot Daily reported on 2026-10-13, older Adobe Commerce and Magento versions held a similar critical stored XSS flaw. That earlier issue also allowed attackers to hijack sessions via stored malicious code. The recurrence of stored XSS in Adobe's web applications highlights persistent risks in form handling. Security teams must treat these disclosures with high priority. The CVSS score of 9.3 indicates a severe threat level. Organizations running unsupported or unpatched versions face immediate exposure.

Next steps

Teams should inventory their Adobe Experience Manager installations immediately. Verify which versions are currently deployed in production and staging environments. Check if any systems fall within the affected ranges of 6.5 LTS up to SP3 or 6.5 up to 6.5.25. If vulnerable versions are present, assess the risk of exposure. Monitor for any official patches or updates from Adobe. Until a fix is confirmed, consider isolating affected systems from untrusted networks. Review access logs for signs of exploitation attempts.

What defenders should look for

Teams usually detect stored XSS through anomalous web traffic patterns. Look for unusual script tags or encoded payloads in form submissions. Check web server logs for requests containing suspicious JavaScript characters. Monitor for unexpected redirects or session token changes in user activity logs. Alert on high-frequency POST requests to form endpoints. Containment moves often include blocking suspicious source IPs. Disable affected forms temporarily if possible. Review user sessions for signs of hijacking. Ensure logging captures full request bodies for forensic analysis.

Background: Session hijacking

Prevent session hijacking by enforcing strict token binding to client fingerprints, setting short expiration times, and isolating session state from predictable generation. This checklist covers network, application, and user-side controls to reduce the window of opportunity for attackers stealing active sessions.

Read the full guide: Session Hijacking Prevention Checklist: Secure Tokens and Boundaries

What to do and how to stay safe: Adobe Experience Manager

• Audit all Adobe Experience Manager instances to identify vulnerable versions.
• Monitor web application firewalls for injected script payloads in form fields.
• Review server logs for unusual JavaScript execution patterns or redirects.
• Isolate affected systems from external networks until a vendor update is available.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Adobe Experience Manager versions are affected by CVE-2026-106629?

Versions 6.5 LTS up to SP3 and 6.5 up to 6.5.25 are affected.

What is the severity rating of this vulnerability?

It is rated Critical with a CVSS score of 9.3.

How can an attacker exploit this flaw?

By injecting malicious scripts into vulnerable form fields that execute in victim browsers.