CVE-2026-84397 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. It allows an attacker with low privileges to inject malicious JavaScript into vulnerable form fields. The injected script executes in the context of the victim's browser when they access the affected page, potentially leading to information disclosure or session hijacking. The vulnerability affects versions up to and including 2026.7.0, SP2, and 6.5.24. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability.

The vulnerability enables attackers with low privileges to execute malicious scripts in the browsers of users who visit the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or manipulation of page content. There is no reported impact on system availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the service is managed and patched server-side. Until an official fix is available, restrict access to vulnerable form fields and apply input validation or sanitization where possible.