CVE-2026-34694 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager Forms JEE affecting versions up to and including 6.5.24.0. A high-privileged attacker can inject malicious JavaScript into vulnerable form fields. When other users browse pages containing these fields, the injected scripts execute in their browsers, potentially leading to information disclosure or session manipulation. The vulnerability scope is changed, indicating a possible impact on multiple security boundaries. The CVSS 3.1 base score is 4.8, reflecting a medium severity with network attack vector, low attack complexity, high privileges required, and user interaction needed.

Successful exploitation allows a high-privileged attacker to execute arbitrary JavaScript in the context of users viewing the vulnerable form fields. This can lead to limited confidentiality and integrity impacts such as theft of session tokens or manipulation of page content. There is no direct availability impact. The vulnerability affects the trust boundary between users and the application interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit high-privileged user access to trusted personnel only and consider applying input validation or output encoding workarounds if feasible. Monitor Adobe's security advisories for updates.