CVE-2026-34691

The vulnerability consists of insufficient input sanitization in form fields of the AEM Forms JEE application. An unauthenticated attacker, but requiring user interaction (UI:R), injects malicious JavaScript into a vulnerable form field, where it is permanently stored (stored XSS). When the victim visits the page containing the infected field, the script is automatically executed in their browser within the application context. The scope change means that the effects extend beyond the vulnerable component itself.

An attacker can execute arbitrary JavaScript code in the victim's browser, enabling session hijacking, credential theft, privilege escalation, or takeover of user accounts. The high impact on confidentiality and integrity makes this threat particularly serious in corporate environments handling sensitive forms.

Patches available from the vendor should be applied according to references — the official Adobe security bulletin is available at: https://helpx.adobe.com/security/products/aem-forms/apsb26-57.html

Adobe Experience Manager Forms JEE in LTS SP1 version, 6.5.24.0 and earlier versions