CVE-2026-34693: Adobe Experience Manager Forms JEE | Cross-site Scripting (Reflected XSS) (CWE-79)

Synopsis

Reflected Cross-Site Scripting (XSS) in Adobe Experience Manager Forms JEE allows a network-based attacker with no authentication to inject malicious scripts into a victim's browser session. The attacker must trick a victim into visiting a crafted URL, and exploitation depends on conditions outside the attacker's direct control (reflected XSS across a changed scope boundary). Successful exploitation grants the attacker high-level read and write access to the victim's session and account data. HarborGuard is tracking this advisory for patch availability, as no fix version has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; the attacker must be able to reach the AEM Forms JEE service from an internet or network-adjacent position to deliver the crafted URL.

• AuthenticationNot required

  No account or credentials are needed; the attacker can initiate the attack as an unauthenticated party, relying entirely on victim interaction to execute the payload.

• Victim interactionRequired

  The victim must click a maliciously crafted URL or visit a compromised web page, making a social-engineering or phishing step a prerequisite for exploitation.

• Attack complexityDetail

  Attack complexity is rated High, meaning the exploit depends on conditions beyond the attacker's direct control, such as specific browser state or environmental factors, making reliable triggering non-trivial.

Blast Radius

• Reads the victim's active session tokens, cookies, and credential material stored or transmitted in the browser context.
• Performs high-impact modifications on behalf of the victim, including submitting forms, changing account settings, or escalating privileges within the AEM Forms JEE application.
• The changed scope means injected scripts can affect browser components or origins beyond the vulnerable page itself, broadening the attacker's reach beyond the directly targeted resource.
• No availability impact is present; the service itself remains running while the attacker operates through the compromised session.