CVE-2026-84397

MediumCVSS 5.4/10Last modified Sep 16, 2026

Description

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Adobe	Adobe Experience Manager as a Cloud Service	<= 2026.7.0
Adobe	Adobe Experience Manager 6.5 LTS	<= SP2
Adobe	Adobe Experience Manager 6.5	<= 6.5.24

References

https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html

Timeline

Published: Sep 16, 2026
Last modified: Sep 16, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-843987.5CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network a CVE-2026-843998.8The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does CVE-2026-844003.1CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An CVE-2026-844036.2The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low En CVE-2026-844088.7QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC whe CVE-2026-844097.5The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metada CVE-2026-84417.5The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX CVE-2026-844107.3In apport before 2.37.0, an improper privilege management vulnerability allows an unprivileged local attacker to gain root privileges on sys CVE-2026-844119.8The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable b CVE-2026-8441210.0Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in CVE-2026-844147.8IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validatio CVE-2026-844187.4IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connec