CVE-2026-34691 is a critical stored cross-site scripting flaw in Adobe Experience Manager Forms on JEE, versions LTS SP1 and 6.5.24.0 and earlier. NVD scores it 9.3. Script in a form field can run in a visitor's browser. Apply the fix in Adobe bulletin APSB26-57.
What's affected
Adobe Experience Manager Forms on JEE, LTS SP1 and 6.5.24.0 and earlier.
The record does not give the fixed build. Check Adobe security bulletin APSB26-57 for the patched version or service pack before you plan the update.
How to check if you're exposed
Look up the AEM Forms JEE version in your deployment's about page or administration console, then compare it with APSB26-57.
Also list which forms are public and which are internal. Public forms widen who can reach the vulnerable field.
What to do now
- Open APSB26-57 and note the fixed version for your release line.
- Schedule the update and apply it to test before production.
- Review stored form field values for markup that should not be there.
- Limit who can author or submit forms that are visible to staff with privileged sessions.
Why it matters
The weakness is CWE-79. The record says malicious JavaScript can be stored in vulnerable form fields and runs when someone browses to the page that contains the field, which could give access to the victim's account or session.
The vector has Scope Changed, so the damage lands in the victim's browser session and not only the form service. Output encoding is the general defense.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Is this exploited in the wild?
The record's KEV flag is false and the text I have does not say so. Treat that as no known exploitation, not as proof of safety.
Sources
Last reviewed: 19 October 2026.
