{"id":"CVE-2026-123259","kind":"vulnerability","aliases":["CVE-2026-123259"],"related":[],"title":"Adobe Experience Manager: stored XSS in form fields runs scripts in browsers","description":"Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.","summary":"A low-privileged user of Adobe Experience Manager can save malicious JavaScript into vulnerable form fields. The script runs in the browser of any victim who opens the page containing that field.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adobe-experience-manager","java","vendor"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T22:18:29+00:00","first_seen_at":"2026-11-10T22:27:28+00:00","triaged_at":"2026-11-10T22:30:47+00:00","updated_at":"2026-11-10T22:30:47+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T22:30:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Adobe Experience Manager: stored XSS in form fields runs scripts in browsers","impact":"medium","summary":"A low-privileged user of Adobe Experience Manager can save malicious JavaScript into vulnerable form fields. The script runs in the browser of any victim who opens the page containing that field.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["adobe-experience-manager","java"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker script runs in victims' browsers on the AEM site","analyst_note":"Find affected AEM versions and fixed release from Adobe's security bulletin; the NVD entry gives no product ranges.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Adobe Experience Manager with the affected versions, where users with low privileges can write to form fields that other users later view. The sources do not name the affected versions or the vulnerable fields. unknown","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000667,"input_tokens":4576,"output_tokens":418,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123259':15A,18A '-2026':14A,17A 'abus':75C 'adob':1A,20B,31B,58C 'adobe-experience-manag':19B 'affect':62C 'attack':81C 'brows':102C 'browser':12A,47B,99C 'chang':112C 'contain':55B,106C 'could':73C 'cross':67C 'cross-sit':66C 'cve':13A,16A 'execut':94C 'experi':2A,21B,32B,59C 'field':8A,41B,57B,89C,109C 'form':7A,40B,88C 'inject':83C 'java':23B 'javascript':37B,91C 'low':27B,79C 'low-privileg':26B,78C 'malici':36B,84C,90C 'manag':3A,22B,33B,60C 'may':92C 'open':52B 'page':54B,105C 'privileg':28B,80C 'run':9A,44B 'save':35B 'scope':110C 'script':10A,43B,69C,85C 'site':68C 'store':4A,65C 'user':29B 'vendor':24B 'victim':50B,97C 'vulner':39B,71C,87C,108C 'xss':5A,70C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Adobe Experience Manager with the affected versions, where users with low privileges can write to form fields that other users later view. The sources do not name the affected versions or the vulnerable fields. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["adobeexperiencemanager","java","medium","vendor"],"campaign_type":null,"search_a":"'-123259':15A,18A '-2026':14A,17A 'adob':1A 'browser':12A 'cve':13A,16A 'experi':2A 'field':8A 'form':7A 'manag':3A 'run':9A 'script':10A 'store':4A 'xss':5A","search_b":"'adob':20B,31B 'adobe-experience-manag':19B 'browser':47B 'contain':55B 'experi':21B,32B 'field':41B,57B 'form':40B 'java':23B 'javascript':37B 'low':27B 'low-privileg':26B 'malici':36B 'manag':22B,33B 'open':52B 'page':54B 'privileg':28B 'run':44B 'save':35B 'script':43B 'user':29B 'vendor':24B 'victim':50B 'vulner':39B","search_c":"'abus':75C 'adob':58C 'affect':62C 'attack':81C 'brows':102C 'browser':99C 'chang':112C 'contain':106C 'could':73C 'cross':67C 'cross-sit':66C 'execut':94C 'experi':59C 'field':89C,109C 'form':88C 'inject':83C 'javascript':91C 'low':79C 'low-privileg':78C 'malici':84C,90C 'manag':60C 'may':92C 'page':105C 'privileg':80C 'scope':110C 'script':69C,85C 'site':68C 'store':65C 'victim':97C 'vulner':71C,87C,108C 'xss':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123259","severity":null,"published_at":"2026-11-10T22:18:29+00:00","modified_at":"2026-11-10T22:18:29+00:00","first_seen_at":"2026-11-10T22:27:28+00:00","fetched_at":"2026-11-10T22:27:28+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}