Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

The version of Adobe Experience Manager installed on the remote host is prior to 2026.8.0, 6.5.3. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-98 advisory.

  - Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers     (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a     crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However,     this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the     vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix     were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2     would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases,     the PDFParser was in the org.apache.tika:tika-parsers module. (CVE-2025-66516)

  - The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength     constraint defined in StreamReadConstraints (default: 1000 characters). An attacker able to submit JSON to     an application that uses the async parser API can supply a number token of arbitrary length, leading to     excessive memory allocation and potential CPU exhaustion, resulting in a denial of service. The     synchronous parser enforces this limit correctly, so the constraint is applied inconsistently depending on     which parsing API the application uses. Root cause: the async parsing path in     NonBlockingUtf8JsonParserBase and related classes never invokes the number length validation methods.
    Number parsing methods such as _finishNumberIntegralPart() accumulate digits into the TextBuffer without     any length check, then call _valueComplete() to finalize the token. _valueComplete() does not call     resetInt() or resetFloat(), which are the methods in ParserBase where validateIntegerLength() and     validateFPLength() are performed. Because that validation step is skipped, maxNumberLength is never     enforced on the async code path. Impact: an attacker sending a JSON document containing an arbitrarily     long number to an application using the async parser (for example a Spring WebFlux or other reactive     application) can cause unbounded allocation in the TextBuffer and an OutOfMemoryError. If the application     subsequently calls getBigIntegerValue() or getDecimalValue(), the JVM may additionally be tied up in     O(n^2) BigInteger parsing, causing CPU-based denial of service. No privileges or user interaction beyond     the ability to submit data for parsing are required. This issue affects     com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.5 and from 2.19.0 through 2.21.0,     and tools.jackson.core:jackson-core from 3.0.0 through 3.0.x. Versions prior to 2.15.0 are not affected,     because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in     jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that     GHSA-72hv-8253-57qq records the lower bound of the affected 2.x range as 2.0.0. (CVE-2026-18401)

  - Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in     arbitrary code execution in the context of the current user, potentially gaining elevated access or     control over the victim's account or session. A low-privileged attacker could exploit this vulnerability     to gain elevated access or control over the victim's account or session. Exploitation of this issue does     not require user interaction. Scope is changed. (CVE-2026-19232)

  - Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be     abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious     JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable     field. Scope is changed. (CVE-2025-64584, CVE-2025-64588, CVE-2025-64589, CVE-2025-64610, CVE-2025-64618,     CVE-2025-64830, CVE-2025-64838, CVE-2025-64854, CVE-2025-64866, CVE-2025-64868, CVE-2026-27222,     CVE-2026-27227, CVE-2026-27238, CVE-2026-27258, CVE-2026-71440, CVE-2026-75642, CVE-2026-75643,     CVE-2026-75644, CVE-2026-75727, CVE-2026-75729, CVE-2026-75730, CVE-2026-75731, CVE-2026-75733,     CVE-2026-75734, CVE-2026-75735, CVE-2026-75736, CVE-2026-75737, CVE-2026-75738, CVE-2026-75739,     CVE-2026-75740, CVE-2026-75741, CVE-2026-75742, CVE-2026-79905)

  - Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker     could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the     context of the victim's browser. Exploitation of this issue requires user interaction in that a victim     must visit a crafted webpage. Scope is changed. (CVE-2025-64542, CVE-2026-19479, CVE-2026-19612,     CVE-2026-19644, CVE-2026-19713, CVE-2026-71356, CVE-2026-71357, CVE-2026-71388, CVE-2026-71565,     CVE-2026-72626, CVE-2026-72627, CVE-2026-75629, CVE-2026-75635, CVE-2026-75636, CVE-2026-75637,     CVE-2026-75639, CVE-2026-75640, CVE-2026-75646, CVE-2026-75647, CVE-2026-75651, CVE-2026-75652,     CVE-2026-75657, CVE-2026-75659, CVE-2026-75660, CVE-2026-75661, CVE-2026-75666, CVE-2026-75667,     CVE-2026-75668, CVE-2026-75669, CVE-2026-75670, CVE-2026-75671, CVE-2026-75672, CVE-2026-75674,     CVE-2026-75675, CVE-2026-75677, CVE-2026-75678, CVE-2026-75679, CVE-2026-75680, CVE-2026-75681,     CVE-2026-75683, CVE-2026-75685, CVE-2026-75687, CVE-2026-75690, CVE-2026-75691, CVE-2026-75692,     CVE-2026-75693, CVE-2026-75694, CVE-2026-75695, CVE-2026-75696, CVE-2026-75700, CVE-2026-75701,     CVE-2026-75702, CVE-2026-75704, CVE-2026-75705, CVE-2026-75706, CVE-2026-75707, CVE-2026-75708,     CVE-2026-75709, CVE-2026-75710, CVE-2026-75711, CVE-2026-75712, CVE-2026-75713, CVE-2026-75714,     CVE-2026-75715, CVE-2026-75716, CVE-2026-75717, CVE-2026-75718, CVE-2026-75719, CVE-2026-75720,     CVE-2026-75722, CVE-2026-75724, CVE-2026-75725)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe InDesign installed on the remote Windows host is prior to 20.5.3, 21.3.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-32 advisory.

  - Heap-based Buffer Overflow (CWE-122) potentially leading to Arbitrary code execution (CVE-2026-34627,     CVE-2026-34628, CVE-2026-34629)

  - InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds write vulnerability     that could result in arbitrary code execution in the context of the current user. Exploitation of this     issue requires user interaction in that a victim must open a malicious file. (CVE-2026-27291)

  - InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Use After Free vulnerability that     could result in arbitrary code execution in the context of the current user. Exploitation of this issue     requires user interaction in that a victim must open a malicious file. (CVE-2026-27283)

  - InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds read vulnerability     when parsing a crafted file, which could result in a read past the end of an allocated memory structure.
    An attacker could leverage this vulnerability to execute code in the context of the current user.
    Exploitation of this issue requires user interaction in that a victim must open a malicious file.
    (CVE-2026-27284)

  - InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow     vulnerability that could result in arbitrary code execution in the context of the current user.
    Exploitation of this issue requires user interaction in that a victim must open a malicious file.
    (CVE-2026-27238)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe InDesign installed on the remote macOS host is prior to 20.5.3, 21.3.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-32 advisory.

  - Heap-based Buffer Overflow (CWE-122) potentially leading to Arbitrary code execution (CVE-2026-34627,     CVE-2026-34628, CVE-2026-34629)

  - InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds write vulnerability     that could result in arbitrary code execution in the context of the current user. Exploitation of this     issue requires user interaction in that a victim must open a malicious file. (CVE-2026-27291)

  - InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Use After Free vulnerability that     could result in arbitrary code execution in the context of the current user. Exploitation of this issue     requires user interaction in that a victim must open a malicious file. (CVE-2026-27283)

  - InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds read vulnerability     when parsing a crafted file, which could result in a read past the end of an allocated memory structure.
    An attacker could leverage this vulnerability to execute code in the context of the current user.
    Exploitation of this issue requires user interaction in that a victim must open a malicious file.
    (CVE-2026-27284)

  - InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow     vulnerability that could result in arbitrary code execution in the context of the current user.
    Exploitation of this issue requires user interaction in that a victim must open a malicious file.
    (CVE-2026-27238)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
344294	Adobe Experience Manager 6.5.0 < 6.5.3 / 2026.7.0 < 2026.8.0 Multiple Vulnerabilities (APSB26-98)	Nessus	Misc.	Remote	medium
306383	Adobe InDesign < 20.5.3 / 21.0 < 21.3.0 Multiple Vulnerabilities (APSB26-32)	Nessus	Windows	Local	high
306382	Adobe InDesign < 20.5.3 / 21.0 < 21.3.0 Multiple Vulnerabilities (APSB26-32) (macOS)	Nessus	MacOS X Local Security Checks	Local	high

Detections

Analytics

CVE-2026-27238

medium

Tenable Plugins

medium

high

high