PT-2026-24533

CVE-2026-27254

Published

2026-03-10

Updated

2026-03-11

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.23 and earlier

Description A stored Cross-Site Scripting (XSS) issue exists in Adobe Experience Manager. A low-privileged attacker could exploit this to inject malicious scripts into vulnerable form fields. Execution of malicious JavaScript may occur in a victim’s browser when navigating to a page containing the vulnerable field.

Recommendations Update Adobe Experience Manager to a version later than 6.5.23.

Exploitability

Fix

Impacts

Researchers

Tavis Ormandy

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2026-27254