#202020

Adobe Security Bulletin

Last updated on Mar 11, 2026

Security updates available for Adobe Experience Manager | APSB26-24

Bulletin ID
Date Published
Priority
APSB26-24
March 10, 2026
3
style
grid width 12

Summary

Adobe has released updates for Adobe Experience Manager (AEM). This update resolves vulnerabilities rated important. Successful exploitation of these vulnerabilities could result in arbitrary code execution.

Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.

Affected product versions

Product
Version
Platform
Adobe Experience Manager (AEM)
AEM Cloud Service (CS)
All
Adobe Experience Manager (AEM)
6.5 LTS SP1 and earlier
6.5.SP23 and earlier
All
style
grid width 12

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:

Product
Version
Platform
Priority
Availability
Adobe Experience Manager (AEM)
AEM Cloud Service (CS) Release 2026.02
All
3
Release Notes
Adobe Experience Manager (AEM)
6.5 LTS Service Pack 2
All
3
Release Notes
Adobe Experience Manager (AEM)
6.5 Service Pack 24
All
3
Release Notes
style
grid width 12

Note

Customers running on Adobe Experience Manager's Cloud Service will automatically receive updates that include new features as well as security and functionality bug fixes.

Note

Experience Manager Security Considerations:

AEM as a Cloud Service Security Considerations

Anonymous Permission Hardening Package

Note

Please contact Adobe customer care for assistance with AEM versions 6.4, 6.3 and 6.2.

style
xl spacing, one up, grid width 8, static-links, xxl-spacing-top

Vulnerability Details

Vulnerability Category
Vulnerability Impact
Severity
CVSS base score
CVSS vector
CVE Number
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27223
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27224
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27225
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27227
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27228
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27229
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27230
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27231
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27232
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27233
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27234
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27235
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27236
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27237
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27239
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27240
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27241
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27242
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27244
Cross-site Scripting (DOM-based XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27247
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27248
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27249
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27250
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27251
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27252
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27253
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27254
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27255
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27256
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27257
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27262
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27265
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27266

Acknowledgments

Adobe would like to thank the following for reporting these issues and for working with Adobe to help protect our customers:

  • green-jam: CVE-2026-27223, CVE-2026-27224, CVE-2026-27225, CVE-2026-27227, CVE-2026-27228, CVE-2026-27229, CVE-2026-27230, CVE-2026-27231, CVE-2026-27232, CVE-2026-27233, CVE-2026-27234, CVE-2026-27235, CVE-2026-27236, CVE-2026-27237, CVE-2026-27239, CVE-2026-27240, CVE-2026-27241, CVE-2026-27242, CVE-2026-27244, CVE-2026-27247, CVE-2026-27248, CVE-2026-27249, CVE-2026-27250, CVE-2026-27251, CVE-2026-27252, CVE-2026-27253, CVE-2026-27254, CVE-2026-27255, CVE-2026-27256, CVE-2026-27257, CVE-2026-27265, CVE-2026-27266
  • anonymous_blackzero: CVE-2026-27262

NOTE: Adobe has a public bug bounty program with HackerOne. If you are interested in working with Adobe as an external security researcher, please check out https://hackerone.com/adobe

For more information, visit https://helpx.adobe.com/security.html, or email PSIRT@adobe.com.

CardTitle
APSB26-24
CardDescription
{**Priority 3**} Security update
CardImage
Adobe
Created
2026-03-10
Tags
caas:content-type/documentation,caas:trust-center/security-bulletin,caas:products/adobe-experience-manager
PrimaryTag
caas:content-type/article
Details
caas:mnemonics/adobe-experience-manager