CVE-2026-27222
published 2026-04-14CVE-2026-27222: Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious…
PriorityP430medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.63%
49.5th percentile
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | adobe_experience_manager_6.5 | <= 6.5.24 | — |
| adobe | adobe_experience_manager_6.5_lts | <= SP2 | — |
| adobe | adobe_experience_manager_as_a_cloud_service | <= 2026.7.0 | — |
| adobe | bridge | < 15.1.5 | 15.1.5 |
| adobe | bridge | >= 16.0 < 16.0.3 | 16.0.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pgvh-5499-q39c: Bridge versions 16
ghsa_unreviewed·2026-04-14
CVE-2026-27222 [MEDIUM] CWE-369 GHSA-pgvh-5499-q39c: Bridge versions 16
Bridge versions 16.0.2, 15.1.4 and earlier are affected by a Divide By Zero vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application or render it unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
VulDB
Adobe Bridge up to 15.1.4/16.0.2 File divide by zero (apsb26-39)
vuldb·2026-04-14·CVSS 5.5
CVE-2026-27222 [MEDIUM] Adobe Bridge up to 15.1.4/16.0.2 File divide by zero (apsb26-39)
A vulnerability described as problematic has been identified in Adobe Bridge up to 15.1.4/16.0.2. Affected by this issue is some unknown functionality of the component File Handler. The manipulation results in divide by zero.
This vulnerability is known as CVE-2026-27222. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is recommended.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-14
Published