CVE-2026-34691: Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)

Synopsis

Stored cross-site scripting (XSS) in Adobe Experience Manager Forms JEE allows an unauthenticated network attacker to inject malicious JavaScript into vulnerable form fields. The injected script executes in a victim's browser when they visit the affected page, requiring no authentication to plant the payload but relying on a victim loading the page. Successful exploitation gives the attacker full read and write access to the victim's session, stored credentials, and account context. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Adobe publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the AEM Forms JEE service over the network to submit a payload into a vulnerable form field.

• AuthenticationNot required

  No account or credentials are needed to inject the malicious script into a vulnerable form field.

• Victim interactionRequired

  A victim must browse to the page containing the injected field, making this a social-engineering or passive-wait attack against authenticated users.

• Attack complexityDetail

  The exploit is reliable and condition-free once the payload is stored; no race conditions or special environmental factors are required.

Blast Radius

• The attacker reads the victim's active session token, enabling full account takeover without needing the victim's password.
• Stored cookies, autofill credentials, and any data rendered on the page are exposed to the attacker's exfiltrated JavaScript output.
• The attacker can perform write actions on the victim's behalf, such as modifying form data, submitting transactions, or changing account settings, within the victim's privilege level.
• Because scope is changed, the injected script can reach and interact with other origins or browser storage beyond the AEM Forms application itself.