CVE-2026-110037 Adobe CVE debrief

Who should care

Defenders responsible for Adobe Experience Manager deployments, particularly those with low-privileged user accounts, should assess exposure and prioritize remediation. Relevant roles include defenders and administrators of Adobe Experience Manager deployments. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

Defenders should care about CVE-2026-110037 because it involves a stored XSS vulnerability in Adobe Experience Manager that could be exploited by low-privileged attackers, potentially leading to malicious script execution in victim browsers. Relevant roles include defenders and administrators of Adobe Experience Manager deployments. Supported consequences include potential JavaScript execution and injection of malicious scripts. Action priority follows from verifying exposure and applying hotfixes. Evidence limits include reliance on official CVE Program and NVD records, as well as vendor advisories.

• Potential for malicious JavaScript execution in victim browsers
• Possible injection of malicious scripts into vulnerable form fields
• Need for verification of exposure in Adobe Experience Manager installations
• Priority for applying vendor-provided hotfixes

Technical summary

A low-privileged attacker could inject malicious scripts into vulnerable form fields in Adobe Experience Manager 6.5 LTS and 6.5, potentially leading to malicious JavaScript execution in a victim's browser. The vulnerability is tracked as GRANITE-75052 and defenders should prioritize verifying exposure in Adobe Experience Manager installations, assessing for vulnerable form fields, and applying vendor-provided hotfixes. The affected product context includes Adobe Experience Manager deployments with low-privileged user accounts.

Defensive priority

Defenders should prioritize verifying exposure in Adobe Experience Manager 6.5 LTS and 6.5 installations, assessing for vulnerable form fields, and applying vendor-provided hotfixes.

Recommended defensive actions

• Verify exposure in Adobe Experience Manager 6.5 LTS and 6.5 installations
• Assess for vulnerable form fields
• Apply vendor-provided hotfixes for GRANITE-75052
• Monitor for low-privileged user activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. Adobe's advisory (APSB26-152) offers vendor-specific guidance. Evidence limits include reliance on official CVE Program and NVD records, as well as vendor advisories. Defenders should verify exposure in Adobe Experience Manager installations and apply vendor-provided hotfixes. The vulnerability is tracked as GRANITE-75052.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.