#202020

Adobe Security Bulletin

Last updated on Sep 16, 2026

Security updates available for Adobe Experience Manager | APSB26-98

Bulletin ID
Date published
Priority
APSB26-98
September 8, 2026
2
style
grid width 12

Summary

Adobe has released a security update for Adobe Experience Manager (AEM). This update addresses important and moderate vulnerabilities that could result in privilege escalation, security feature bypass, and arbitrary code execution.

Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.

Affected product versions

Product
Version
Platform
Adobe Experience Manager (AEM)
AEM Cloud Service (CS) Release 2026.7.0 and earlier
All
Adobe Experience Manager (AEM)
6.5 LTS Service Pack 2 and earlier
All
Adobe Experience Manager (AEM)
6.5 Service Pack 24 and earlier
All
style
grid width 12

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:

Product
Version
Platform
Priority
Availability
Adobe Experience Manager (AEM)
AEM Cloud Service (CS) Release 2026.8.0
All
2
Release Notes
Adobe Experience Manager (AEM)
6.5 LTS Service Pack 3
All
2
Release Notes
Adobe Experience Manager (AEM)
6.5 Service Pack 25
All
2
Release Notes
style
grid width 12

Vulnerability Details

CVE-2026-19232
Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2025-64830
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75735
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-84397
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75736
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75737
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75738
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-71440
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27227
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75739
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2025-64618
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2025-64610
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75740
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75741
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2025-64589
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2025-64588
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75742
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2025-64584
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27222
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-71357
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
TBD
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
TBD
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
TBD
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
TBD
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2025-64542
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75719
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75720
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75722
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75724
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75725
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-71356
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75727
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-79905
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-27258
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2025-64868
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2025-64866
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75729
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2025-64854
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-71388
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75730
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75731
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2025-64838
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75733
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75734
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75695
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75696
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75700
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75701
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75702
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75704
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75705
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75706
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75707
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75708
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75709
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75710
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75711
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75712
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75713
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75714
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75715
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75716
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75717
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75718
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75668
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75669
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75670
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75671
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75672
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75674
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75675
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75677
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75678
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75679
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75680
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75681
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75683
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75685
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75687
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75690
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75691
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75692
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75693
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75694
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-19713
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75629
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75635
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75636
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75637
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75639
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75640
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75642
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75643
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75644
Vulnerability category: Cross-site Scripting (Stored XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75646
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75647
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75651
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75652
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75657
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75659
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75660
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75661
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75666
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75667
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-19644
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-19612
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-19479
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-72627
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-72626
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-71565
Vulnerability category: Cross-site Scripting (DOM-based XSS) (CWE-79)
Vulnerability impact: Arbitrary code execution
Severity: Important
CVSS base score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2026-75726
Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Security feature bypass
Severity: Moderate
CVSS base score: 3.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Note

AEM 6.5 Service Pack and LTS versions are not impacted by the following CVEs: CVE-2026-19232

Note

Effective August 11, 2026, Adobe may assign a single CVE identifier to internally discovered vulnerabilities with the same severity rating and CWE category when a release includes systemic fixes.

style
xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Updates to Dependencies

CVE
Dependency
Updated Version
Notes
CVE-2026-18401
Jackson-databind
2.21.3
Delivered in Service Pack 25
CVE-2025-66516
Apache Tika
1.28.6-B0002
Delivered in LTS Service Pack 3

Acknowledgments

Adobe would like to thank the following for reporting these issues and for working with Adobe to help protect our customers:

  • Om Ochhane (cod3rjava) — CVE-2026-19232
  • Jim Green (green-jam) — CVE-2025-64830, CVE-2026-75735, CVE-2026-27238, CVE-2026-75736, CVE-2026-75737, CVE-2026-75738, CVE-2026-71440, CVE-2026-27227, CVE-2026-75739, CVE-2025-64618, CVE-2025-64610, CVE-2026-75741, CVE-2025-64589, CVE-2025-64588, CVE-2026-75742, CVE-2025-64584, CVE-2026-27222, CVE-2026-71357, CVE-2025-64542, CVE-2026-75719, CVE-2026-75720, CVE-2026-75722, CVE-2026-75724, CVE-2026-75725, CVE-2026-71356, CVE-2025-64868, CVE-2025-64866, CVE-2026-75729, CVE-2025-64854, CVE-2026-71388, CVE-2026-75730, CVE-2026-75731, CVE-2025-64838, CVE-2026-75733, CVE-2026-75734, CVE-2026-75695, CVE-2026-75696, CVE-2026-75700, CVE-2026-75701, CVE-2026-75702, CVE-2026-75704, CVE-2026-75705, CVE-2026-75706, CVE-2026-75707, CVE-2026-75708, CVE-2026-75709, CVE-2026-75710, CVE-2026-75711, CVE-2026-75712, CVE-2026-75713, CVE-2026-75714, CVE-2026-75715, CVE-2026-75716, CVE-2026-75717, CVE-2026-75718, CVE-2026-75668, CVE-2026-75669, CVE-2026-75670, CVE-2026-75671, CVE-2026-75672, CVE-2026-75674, CVE-2026-75675, CVE-2026-75677, CVE-2026-75678, CVE-2026-75679, CVE-2026-75680, CVE-2026-75681, CVE-2026-75683, CVE-2026-75685, CVE-2026-75687, CVE-2026-75690, CVE-2026-75691, CVE-2026-75692, CVE-2026-75693, CVE-2026-75694, CVE-2026-19713, CVE-2026-75629, CVE-2026-75635, CVE-2026-75636, CVE-2026-75637, CVE-2026-75639, CVE-2026-75640, CVE-2026-75646, CVE-2026-75647, CVE-2026-75651, CVE-2026-75652, CVE-2026-75657, CVE-2026-75659, CVE-2026-75660, CVE-2026-75661, CVE-2026-75666, CVE-2026-75667, CVE-2026-19644, CVE-2026-19612, CVE-2026-19479, CVE-2026-72627, CVE-2026-72626, CVE-2026-71565
  • anonymous_blackzero — CVE-2026-75727, CVE-2026-79905, CVE-2026-27258, CVE-2026-75642, CVE-2026-75643, CVE-2026-75644, CVE-2026-75726

Revisions

NOTE: Adobe has a public bug bounty program with Intigriti. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail.

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com.

CardTitle
APSB26-98
CardDescription
Priority 2 Security update
CardImage
Adobe
Created
2026-09-08
Tags
caas:content-type/documentation,caas:trust-center/security-bulletin,caas:products/adobe-experience-manager
PrimaryTag
caas:content-type/article
Details
caas:mnemonics/adobe-experience-manager
Arbitrary
search: CVE-2026-19232 CVE-2025-64830 CVE-2026-75735 CVE-2026-84397 CVE-2026-75736 CVE-2026-75737 CVE-2026-75738 CVE-2026-71440 CVE-2026-27227 CVE-2026-75739 CVE-2025-64618 CVE-2025-64610 CVE-2026-75740 CVE-2026-75741 CVE-2025-64589 CVE-2025-64588 CVE-2026-75742 CVE-2025-64584 CVE-2026-27222 CVE-2026-71357 CVE-2025-64542 CVE-2026-75719 CVE-2026-75720 CVE-2026-75722 CVE-2026-75724 CVE-2026-75725 CVE-2026-71356 CVE-2026-75727 CVE-2026-79905 CVE-2026-27258 CVE-2025-64868 CVE-2025-64866 CVE-2026-75729 CVE-2025-64854 CVE-2026-71388 CVE-2026-75730 CVE-2026-75731 CVE-2025-64838 CVE-2026-75733 CVE-2026-75734 CVE-2026-75695 CVE-2026-75696 CVE-2026-75700 CVE-2026-75701 CVE-2026-75702 CVE-2026-75704 CVE-2026-75705 CVE-2026-75706 CVE-2026-75707 CVE-2026-75708 CVE-2026-75709 CVE-2026-75710 CVE-2026-75711 CVE-2026-75712 CVE-2026-75713 CVE-2026-75714 CVE-2026-75715 CVE-2026-75716 CVE-2026-75717 CVE-2026-75718 CVE-2026-75668 CVE-2026-75669 CVE-2026-75670 CVE-2026-75671 CVE-2026-75672 CVE-2026-75674 CVE-2026-75675 CVE-2026-75677 CVE-2026-75678 CVE-2026-75679 CVE-2026-75680 CVE-2026-75681 CVE-2026-75683 CVE-2026-75685 CVE-2026-75687 CVE-2026-75690 CVE-2026-75691 CVE-2026-75692 CVE-2026-75693 CVE-2026-75694 CVE-2026-19713 CVE-2026-75629 CVE-2026-75635 CVE-2026-75636 CVE-2026-75637 CVE-2026-75639 CVE-2026-75640 CVE-2026-75642 CVE-2026-75643 CVE-2026-75644 CVE-2026-75646 CVE-2026-75647 CVE-2026-75651 CVE-2026-75652 CVE-2026-75657 CVE-2026-75659 CVE-2026-75660 CVE-2026-75661 CVE-2026-75666 CVE-2026-75667 CVE-2026-19644 CVE-2026-19612 CVE-2026-19479 CVE-2026-72627 CVE-2026-72626 CVE-2026-71565 CVE-2026-75726 CVE-2026-27238