Review reviewCritical

CVE-2026-34691

Adobe Adobe Experience Manager Forms JEE, experience manager, iphone os

Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

CVSS: 9.3
EPSS: 0.36%
CISA KEV: Not listed
Published: 2026.06.10

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.36%

Technical severityCVSS 9.3

Vulnerability overview

Affected product and versions

Product: Adobe Adobe Experience Manager Forms JEE, experience manager, iphone os
Affected versions: <= 6.5.24.0, 6.5
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Adobe Adobe Experience Manager Forms JEE, experience manager, iphone os and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CWE: CWE-79