CVE-2026-34691CWE-79cross-site-scripting

CVE-2026-34691

Critical · published June 9, 2026

CVSS v3.1
9.3
EPSS
1%
Percentile
54.2
In the wild
Unconfirmed
What it is

Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00744 · 54.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-06-09T22:16Z
Affected products (3)
ProductVersionsFixed in
adobe/experience_manager≤ 6.5.24.0—
adobe/experience_managerall versions—
adobe/experience_managerall versions—
References (1)
https://helpx.adobe.com/security/products/aem-forms/apsb26-57.html · [email protected]
EPSS history
Timeline
  • 09 JUN 17:13Z
    Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)
    cvelistv5