All vulnerabilities
CVE-2026-83662

Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)

Adobe Adobe Experience Manager as a Cloud Service
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.72%Chance of exploitation activity in the next 30 days, higher than 53% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published13 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Text from CVE List

Affected versions 6

  • Adobe Experience Manager as a Cloud Serviceaffected: all versions through 2026.9.28187CVE List
  • Adobe Experience Manager as a Cloud Serviceunaffected: 2026.9.28386CVE List
  • Adobe Experience Manager 6.5 LTSaffected: all versions through 6.5 LTS SP3CVE List
  • Adobe Experience Manager 6.5 LTSunaffected: 6.5 LTS SP3 - Hotfix for SITES-49893 + SITES-49334 + SITES-48208CVE List
  • Adobe Experience Manager 6.5affected: all versions through 6.5.25CVE List
  • Adobe Experience Manager 6.5unaffected: 6.5.25 - Hotfix for SITES-49894 + SITES-49335 + SITES-48207CVE List

References 1