CVE-2026-34691
Adobe Experience Manager Forms JEE LTS SP1, version 6.5.24.0 and earlier contain a stored cross‑site scripting flaw. The vulnerability lets an attacker embed malicious JavaScript into form fields that will run when a user views the page. This can give the attacker elevated access or control over the victim’s account.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Adobe Experience Manager Forms JEE LTS SP1, 6.5.24.0 and earlier.
Real-world impact
An attacker can inject and execute JavaScript in a victim’s browser when they view a vulnerable form, potentially taking over the victim’s session or gaining elevated privileges.
Why this severity
The CVSS score of 9.3 reflects a network‑accessible attack with low effort, no privileges, and user interaction required. The vulnerability changes the scope and provides high confidentiality and integrity impact, leading to a critical rating.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 9, 2026 · Jun 9, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 5d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- helpx.adobe.com/security/products/aem-forms…vendor advisory