CVE-2026-84397 in Experience Manager as a Cloud Service
Summary
by MITRE • 09/16/2026
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
Adobe Experience Manager contains a stored Cross-Site Scripting vulnerability within its content management and form processing subsystems, specifically affecting how user-supplied data is rendered back into web pages without adequate sanitization or encoding. This flaw allows an attacker with low-privileged access to inject malicious JavaScript code directly into vulnerable form fields during the initial submission phase. Unlike reflected XSS where the payload is delivered via a crafted link, stored XSS persists on the target server because the injected script becomes part of the page content itself. Consequently, every user who subsequently views or interacts with the affected page will have their browser execute the malicious scripts automatically, creating a persistent threat vector that does not require social engineering to trigger beyond the initial injection by the low-privileged attacker.
The operational impact of this vulnerability is significant because it effectively bypasses authentication and authorization controls for any victim user who accesses the compromised content. Once executed in the context of the Adobe Experience Manager application, the malicious JavaScript inherits the privileges and session cookies of the victim browser. This can lead to a complete compromise of the victim's account, including unauthorized access to sensitive corporate data, modification or deletion of critical website content, defacement of public-facing pages, or redirection to phishing sites designed to steal credentials. The scope change noted in vulnerability reports indicates that this issue may affect broader areas of the application than previously understood, potentially impacting multiple modules within the Experience Manager suite rather than a single isolated component.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and specifically falls under the stored variant where malicious scripts are permanently stored in target servers such as databases or message boards. In terms of adversary tactics, this technique corresponds to ATT&CK T1059 Command and Control using JavaScript for execution within web browsers and potentially T1078 Valid Accounts if low-privileged users can leverage their existing access to inject payloads that escalate privileges through subsequent interactions with higher-level administrators who view the compromised pages.
Mitigation strategies should prioritize immediate patching of Adobe Experience Manager to the latest version provided by Adobe, which includes fixes for input validation and output encoding issues in form handling components. In environments where patching is not immediately feasible, network-based protections such as Web Application Firewalls can be configured to detect and block common XSS payload patterns within HTTP POST requests targeting vulnerable endpoints. Additionally, implementing strict Content Security Policy headers that restrict script execution sources can significantly reduce the impact of any successfully injected scripts by preventing them from loading external resources or executing arbitrary code unless explicitly allowed by policy. Regular security audits focusing on input validation across all user-facing forms and ensuring that output encoding is applied consistently before rendering data in HTML contexts are essential long-term defenses against this class of vulnerabilities.