Experience Manager Adobe Experience Manager Adobe Experience Manager (AEM), is a comprehensive content management solution for building websites, mobile apps and forms

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in Adobe Experience Manager.

Recent Adobe Experience Manager Security Advisories

Advisory Title Published
APSB26-151 Security updates available for Adobe Experience Manager (AEM) Forms | APSB26-151 September 22, 2026
APSB26-98 Security updates available for Adobe Experience Manager | APSB26-98 September 8, 2026
APSB26-74 Security updates available for Adobe Experience Manager | APSB26-74 July 14, 2026
APSB26-56 Security updates available for Adobe Experience Manager | APSB26-24 APSB26-56 June 9, 2026
APSB26-57 Security updates available for Adobe Experience Manager (AEM) Forms | APSB26-57 June 9, 2026
APSB26-34 Security updates available for Adobe Experience Manager Screens | APSB26-34 April 14, 2026
APSB26-24 Security updates available for Adobe Experience Manager | APSB26-24 March 10, 2026
APSB25-115 Security updates available for Adobe Experience Manager | APSB25-115 December 9, 2025
APSB25-98 Security updates available for Adobe Experience Manager Screens | APSB25-98 October 14, 2025
APSB25-90 Security updates available for Adobe Experience Manager | APSB25-90 September 9, 2025

By the Year

In 2026 there have been 230 vulnerabilities in Adobe Experience Manager with an average score of 5.6 out of ten. Last year, in 2025 Experience Manager had 369 security vulnerabilities published. Right now, Experience Manager is on track to have less security vulnerabilities in 2026 than it did last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.12.




Year Vulnerabilities Average Score
2026 230 5.60
2025 369 5.48
2024 315 5.36
2023 218 5.41
2022 57 5.52
2021 12 6.76
2020 24 7.57
2019 20 6.10
2018 16 6.41

It may take a day or so for new Experience Manager vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Adobe Experience Manager Security Vulnerabilities

Adobe Experience Manager Forms JEE CSRF Bypass Vulnerability
CVE-2026-75743 7.1 - High - September 22, 2026

Adobe Experience Manager Forms JEE is affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access, causing a limited disruption to availability. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

Session Riding

Adobe Experience Manager Forms JEE: Incorrect Auth Enables Arbitrary Code Exec
CVE-2026-75745 10 - Critical - September 22, 2026

Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

AuthZ

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability
CVE-2026-82000 9.6 - Critical - September 22, 2026

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

SSRF

Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting (XSS) vulnerability
CVE-2026-75744 8.1 - High - September 22, 2026

Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

XSS

Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability
CVE-2026-81995 9.1 - Critical - September 22, 2026

Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Improper Input Validation

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability
CVE-2026-81999 8.7 - High - September 22, 2026

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

SSRF

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability
CVE-2026-84397 5.4 - Medium - September 16, 2026

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

XSS

Adobe Experience Manager DOM-based XSS Allowing Client-Side JS Execution
CVE-2026-71357 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager DOM-based XSS Vulnerability
CVE-2026-75678 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager DOM XSS in Java Web Component
CVE-2026-71565 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager DOM XSS (CVE-2026-75687)
CVE-2026-75687 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager DOM XSS Vulnerability (CVE-2026-75672)
CVE-2026-75672 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager Stored XSS in Form Fields
CVE-2026-75734 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

XSS

Adobe Experience Manager DOM XSS Vulnerability (CVE-2026-75706)
CVE-2026-75706 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager XSS in Stored Form Fields
CVE-2026-75730 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

XSS

AEM DOM-based XSS via crafted page
CVE-2026-75719 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager: DOMBased XSS Vulnerability (CVE202675707)
CVE-2026-75707 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager DOM-based XSS Vulnerability (CVE-2026-75690)
CVE-2026-75690 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager DOM-based XSS via Crafted Page
CVE-2026-75715 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

AEM Stored XSS in Form Fields (CVE-2025-64838)
CVE-2025-64838 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

XSS

Adobe Experience Manager DOM XSS Vulnerability (CVE-2026-75640)
CVE-2026-75640 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager DOM-based XSS via crafted URL
CVE-2026-75646 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager Stored XSS in Form Fields
CVE-2026-75643 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

XSS

Adobe AEM Input Validation Flaw Enables Security Bypass
CVE-2026-75726 3.5 - Low - September 08, 2026

Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

Improper Input Validation

Adobe Experience Manager DOM XSS Vulnerability (CVE-2026-19612)
CVE-2026-19612 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager DOM-based XSS Vulnerability
CVE-2026-75660 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager DOM XSS Vulnerability (CVE-2026-19479)
CVE-2026-19479 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager Stored XSS in Form Fields (CVE-2026-75735)
CVE-2026-75735 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

XSS

Adobe Experience Manager DOM XSS (CVE-2026-75637)
CVE-2026-75637 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager DOM XSS (CVE-2026-75705)
CVE-2026-75705 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager DOM XSS Vulnerability (CVE-2026-75694)
CVE-2026-75694 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

AEM Stored XSS Vulnerability (CVE-2026-75741)
CVE-2026-75741 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

XSS

Adobe Experience Manager DOM XSS Vulnerability (CVE-2026-75679)
CVE-2026-75679 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager Stored XSS in Form Fields
CVE-2025-64830 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

XSS

Adobe Experience Manager Stored XSS in Form Fields
CVE-2026-75729 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

XSS

Adobe Experience Manager DOM XSS Vulnerability (CVE-2026-75685)
CVE-2026-75685 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager DOM-based XSS via crafted webpage
CVE-2026-75677 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager Stored XSS in Form Fields
CVE-2026-75642 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

XSS

AEM DOM-Based XSS in Adobe Experience Manager
CVE-2026-75671 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager DOM-based XSS Vulnerability (CVE-2026-75636)
CVE-2026-75636 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager DOM XSS Vulnerability
CVE-2026-75667 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager Stored XSS in Form Fields
CVE-2026-75644 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

XSS

Adobe Experience Manager DOM XSS (CVE-2026-75708)
CVE-2026-75708 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

DOM-XSS in Adobe Experience Manager
CVE-2026-75704 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager Stored XSS in Form Fields
CVE-2025-64854 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

XSS

Adobe Experience Manager Stored XSS in Form Fields
CVE-2025-64866 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

XSS

Adobe Experience Manager DOM-based XSS (CVE-2026-75635)
CVE-2026-75635 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Adobe Experience Manager Stored XSS via Form Field Injection
CVE-2025-64589 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

XSS

Adobe Experience Manager XSS in Form Fields (CVE-2026-75742)
CVE-2026-75742 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

XSS

DOM XSS in Adobe Experience Manager
CVE-2026-75713 5.4 - Medium - September 08, 2026

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

XSS

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for Adobe Experience Manager or by Adobe? Click the Watch button to subscribe.

Adobe
Vendor

Adobe Experience Manager
Adobe Experience Manager (AEM), is a comprehensive content management solution for building websites, mobile apps and forms

subscribe