Bulletin ID
Last updated on
Sep 8, 2026
Security updates available for Adobe Experience Manager | APSB26-98
|
|
Date Published |
Priority |
|---|---|---|
|
APSB26-98 |
September 8, 2026 |
2 |
Summary
Adobe has released a security update for Adobe Experience Manager (AEM). This update addresses important and moderate vulnerabilities that could result in privilege escalation, security feature bypass, and arbitrary code execution.
Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.
Affected product versions
Product |
Version |
Platform |
|---|---|---|
| Adobe Experience Manager (AEM) |
AEM Cloud Service (CS) Release 2026.7.0 and earlier | All |
| Adobe Experience Manager (AEM) | 6.5 LTS Service Pack 2 and earlier | All |
| Adobe Experience Manager (AEM) | 6.5 Service Pack 24 and earlier | All |
Solution
Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:
Product |
Version |
Platform |
Priority |
Availability |
|---|---|---|---|---|
| Adobe Experience Manager (AEM) |
AEM Cloud Service (CS) Release 2026.8.0 | All | 2 | Release Notes |
| Adobe Experience Manager (AEM) | 6.5 LTS Service Pack 3 | All | 2 | Release Notes |
| Adobe Experience Manager (AEM) | 6.5 Service Pack 25 | All | 2 | Release Notes |
Vulnerability Details
| Vulnerability Category |
Vulnerability Impact |
Severity |
CVSS base score |
CVSS vector |
CVE Number |
| Incorrect Authorization (CWE-863) | Arbitrary code execution | Critical | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | CVE-2026-19232 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2025-64830 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75735 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-27238 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75736 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75737 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75738 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-71440 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-27227 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75739 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2025-64618 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2025-64610 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75740 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75741 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2025-64589 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2025-64588 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75742 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2025-64584 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Privilege escalation |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-27222 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-71357 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2025-64542 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Privilege escalation |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75719 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Privilege escalation |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75720 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75722 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Privilege escalation |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75724 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75725 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-71356 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75727 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-79905 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-27258 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2025-64868 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2025-64866 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75729 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2025-64854 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-71388 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75730 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75731 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2025-64838 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75733 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75734 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Privilege escalation |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75695 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Privilege escalation |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75696 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75700 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75701 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75702 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75704 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75705 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75706 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75707 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75708 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75709 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75710 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75711 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75712 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75713 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75714 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Privilege escalation |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75715 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75716 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75717 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75718 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75668 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75669 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75670 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75671 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Privilege escalation |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75672 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75674 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75675 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75677 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75678 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75679 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75680 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75681 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75683 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75685 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75687 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Privilege escalation |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75690 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75691 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Privilege escalation |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75692 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75693 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75694 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-19713 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75629 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75635 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75636 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75637 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75639 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75640 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75642 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75643 |
Cross-site Scripting (Stored XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75644 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75646 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75647 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75651 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75652 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75657 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75659 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75660 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75661 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75666 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-75667 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-19644 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-19612 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-19479 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-72627 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-72626 |
Cross-site Scripting (DOM-based XSS) (CWE-79) |
Arbitrary code execution |
Important |
5.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
CVE-2026-71565 |
Improper Input Validation (CWE-20) |
Security feature bypass |
Moderate |
3.5 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N |
CVE-2026-75726 |
Note
Effective August 11, 2026, Adobe may assign a single CVE identifier to internally discovered vulnerabilities with the same severity rating and CWE category when a release includes systemic fixes.
Updates to Dependencies
| CVE | Dependency |
Updated Version |
Notes |
| CVE-2026-18401 | Jackson-databind |
2.21.3 | Delivered in Service Pack 25 |
| CVE-2025-66516 | Apache Tika | 1.28.6-B0002 | Delivered in LTS Service Pack 3 |
Acknowledgments
Adobe would like to thank the following for reporting these issues and for working with Adobe to help protect our customers:
- Om Ochhane (cod3rjava) — CVE-2026-19232
- Jim Green (green-jam) — CVE-2025-64830, CVE-2026-75735, CVE-2026-27238, CVE-2026-75736, CVE-2026-75737, CVE-2026-75738, CVE-2026-71440, CVE-2026-27227, CVE-2026-75739, CVE-2025-64618, CVE-2025-64610, CVE-2026-75741, CVE-2025-64589, CVE-2025-64588, CVE-2026-75742, CVE-2025-64584, CVE-2026-27222, CVE-2026-71357, CVE-2025-64542, CVE-2026-75719, CVE-2026-75720, CVE-2026-75722, CVE-2026-75724, CVE-2026-75725, CVE-2026-71356, CVE-2025-64868, CVE-2025-64866, CVE-2026-75729, CVE-2025-64854, CVE-2026-71388, CVE-2026-75730, CVE-2026-75731, CVE-2025-64838, CVE-2026-75733, CVE-2026-75734, CVE-2026-75695, CVE-2026-75696, CVE-2026-75700, CVE-2026-75701, CVE-2026-75702, CVE-2026-75704, CVE-2026-75705, CVE-2026-75706, CVE-2026-75707, CVE-2026-75708, CVE-2026-75709, CVE-2026-75710, CVE-2026-75711, CVE-2026-75712, CVE-2026-75713, CVE-2026-75714, CVE-2026-75715, CVE-2026-75716, CVE-2026-75717, CVE-2026-75718, CVE-2026-75668, CVE-2026-75669, CVE-2026-75670, CVE-2026-75671, CVE-2026-75672, CVE-2026-75674, CVE-2026-75675, CVE-2026-75677, CVE-2026-75678, CVE-2026-75679, CVE-2026-75680, CVE-2026-75681, CVE-2026-75683, CVE-2026-75685, CVE-2026-75687, CVE-2026-75690, CVE-2026-75691, CVE-2026-75692, CVE-2026-75693, CVE-2026-75694, CVE-2026-19713, CVE-2026-75629, CVE-2026-75635, CVE-2026-75636, CVE-2026-75637, CVE-2026-75639, CVE-2026-75640, CVE-2026-75646, CVE-2026-75647, CVE-2026-75651, CVE-2026-75652, CVE-2026-75657, CVE-2026-75659, CVE-2026-75660, CVE-2026-75661, CVE-2026-75666, CVE-2026-75667, CVE-2026-19644, CVE-2026-19612, CVE-2026-19479, CVE-2026-72627, CVE-2026-72626, CVE-2026-71565
- anonymous_blackzero — CVE-2026-75727, CVE-2026-79905, CVE-2026-27258, CVE-2026-75642, CVE-2026-75643, CVE-2026-75644, CVE-2026-75726
Revisions
July 15, 2026: Corrected affected versions.
For more information, visit https://helpx.adobe.com/security.html, or email PSIRT@adobe.com.
