# Adobe Experience Manager patches 100+ flaws

Published: 2026-09-09 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/a1ef5783-1d62-5ee4-a807-8c389a25e4bf/adobe-experience-manager-patches-100-flaws

> Adobe fixed over 100 vulnerabilities in Experience Manager, including a critical 9.9 authorization bug allowing code execution without interaction, plus widespread XSS issues.

NCSC-NL published an advisory summarizing a large batch of vulnerabilities patched by Adobe in Adobe Experience Manager (AEM). The bulk of the issues are Cross-Site Scripting (XSS) flaws, both DOM-based and stored, stemming from insufficient input sanitization and output encoding in form components. These allow an attacker to inject and execute malicious JavaScript in the browser of a user who visits or interacts with a crafted page, potentially leading to unauthorized actions in the context of the victim's session.

Of particular note is CVE-2026-19232 (CVSS 9.9), an Incorrect Authorization vulnerability that allows a low-privileged attacker to execute arbitrary code without any user interaction due to improper authorization checks within the application. CVE-2026-27238 (CVSS 7.8) is also notably higher severity than the rest of the batch. An additional Improper Input Validation issue allows security control bypass and acquisition of restricted write permissions via malicious URLs or webpages. No evidence of active exploitation in the wild is mentioned in this advisory; it is a routine vendor patch release.

Defenders running Adobe Experience Manager should apply the vendor updates referenced in the advisory as soon as feasible, prioritizing patching for CVE-2026-19232 given its severity and lack of required user interaction. Organizations should also review AEM instances for exposure to form components handling untrusted input, and monitor for anomalous authorization or session activity consistent with XSS or authorization-bypass exploitation attempts.

## Mentioned in this report

- Vulnerabilities: CVE-2025-64542, CVE-2025-64584, CVE-2025-64588, CVE-2025-64589, CVE-2025-64610, CVE-2025-64618, CVE-2025-64830, CVE-2025-64838, CVE-2025-64854, CVE-2025-64866, CVE-2025-64868, CVE-2026-19232, CVE-2026-19479, CVE-2026-19612, CVE-2026-19644, CVE-2026-19713, CVE-2026-27222, CVE-2026-27227, CVE-2026-27238, CVE-2026-27258, CVE-2026-71356, CVE-2026-71357, CVE-2026-71388, CVE-2026-71440, CVE-2026-71565, CVE-2026-72626, CVE-2026-72627, CVE-2026-75629, CVE-2026-75635, CVE-2026-75636, CVE-2026-75637, CVE-2026-75639, CVE-2026-75640, CVE-2026-75642, CVE-2026-75643, CVE-2026-75644, CVE-2026-75646, CVE-2026-75647, CVE-2026-75726, CVE-2026-79905

## Detection guidance (public sample)

### Suspicious JavaScript Execution from AEM Form Components

ATT&CK: T1059.007

Detects JavaScript execution in browser context originating from Adobe Experience Manager form component responses, indicative of XSS payload delivery. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious JavaScript Execution from AEM Form Components
description: Detects JavaScript code execution initiated by HTTP responses from AEM
  form component endpoints, which may indicate stored or DOM-based XSS exploitation.
  Monitors for anomalous script execution patterns following requests to known AEM
  form handling paths.
tags:
- attack.execution
- attack.t1059.007
logsource:
  category: proxy
  product: windows
detection:
  selection:
    DestinationHostname|contains:
    - /forms/
    - /content/forms/
    http_method: GET|POST
    response_code: '200'
    http_response_body|contains:
    - <script
    - 'javascript:'
    - onerror=
    - onload=
    - onclick=
  filter_legitimate_form_response:
    http_response_body|contains:
    - Content-Security-Policy
    - 'X-Content-Type-Options: nosniff'
  condition: selection and not filter_legitimate_form_response
falsepositives:
- Legitimate AEM form components with embedded client-side validation scripts
- Developer testing environments with unencoded form responses
level: medium
id: 6f70411e-9a4d-5dbe-8aff-a06f0753a1b7
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0363.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a1ef5783-1d62-5ee4-a807-8c389a25e4bf/adobe-experience-manager-patches-100-flaws.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup