CVE-2026-34691 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager Forms JEE, affecting versions LTS SP1, 6.5.24.0 and earlier. The vulnerability allows attackers to inject malicious JavaScript into vulnerable form fields, which executes in the context of users' browsers when they access the affected pages. This can result in elevated privileges or session hijacking. The CVSS 3.1 base score is 9.3, indicating critical severity. No vendor advisory or patch information is available at this time, and the remediation level is unspecified.

An attacker exploiting this stored XSS vulnerability can execute arbitrary JavaScript in the context of a victim's browser. This may lead to account compromise or session hijacking, granting the attacker elevated access or control over the victim's account. The vulnerability does not impact availability but has high confidentiality and integrity impacts as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to affected forms and applying input validation or output encoding as temporary mitigations where possible.