How many Adobe experience manager CVEs are in CISA KEV?

None of Adobe experience manager's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for Adobe experience manager vulnerabilities?

Yes — 1 of Adobe experience manager's CVEs have a known public exploit.

Which versions of Adobe experience manager are affected?

145 distinct Adobe experience manager versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Adobe experience manager CVEs?

Adobe experience manager's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-20 (Improper Input Validation), CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

How many critical Adobe experience manager vulnerabilities are there?

Adobe experience manager has 19 critical and 36 high-severity CVEs.

What is the average severity of Adobe experience manager CVEs?

The average CVSS base score across Adobe experience manager's scored CVEs is 5.5.

RadicalNotion.AI

Log in Start free

Adobe

1,269 CVEs

Adobe experience manager Vulnerabilities

Name: Adobe experience manager vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for experience manager by Adobe.

1,269

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

1

Public exploits

PoC or exploit code

5.5

Avg CVSS

2016–2026

Last updated September 8, 2026

Overview

Adobe experience manager has 1,269 published CVE records since 2016, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 1 have a known public exploit. The average CVSS base score across scored CVEs is 5.5.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Adobe experience manager, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list. Affected platforms include android, ios, kernel, linux, macos, windows.

Severity and exploitation

How the CVSS severity of Adobe experience manager's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical19

High36

Medium1,203

Low11

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Adobe experience manager's CVEs are currently listed in CISA's KEV catalog.

Public exploits

1

One of Adobe experience manager's CVEs has a known public exploit available.

Affected versions and CVEs

Browse every Adobe experience manager version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

<= 6.5.6.01 CVE
<= AEM Cloud Service1 CVE
<= Forms SP6 add-on for AEM 6.5.6.01 CVE
<= Forms SP8 add-on for AEM 6.4.8.21 CVE
<= None1 CVE

Version ranges

6.5 <= v <= 6.5342 CVEs
< 6.5.23.0238 CVEs
< 2025.5.0234 CVEs
< 6.5.25.0161 CVEs
< 2024.5154 CVEs
< 6.5.21154 CVEs
< 6.5.24.0139 CVEs
<= 6.5.18.0124 CVEs
< 2025.12.0115 CVEs
< 2026.8.0104 CVEs
< 2024.11.0100 CVEs
< 6.5.22.096 CVEs
<= 6.5.1871 CVEs
< 6.5.20.060 CVEs
< 2024.3.058 CVEs
< 2026.5.057 CVEs
<= 6.5.2046 CVEs
< 6.544 CVEs
< 6.5.15.034 CVEs
<= 6.5.14.034 CVEs
< 2026.2.033 CVEs
<= 6.5.1928 CVEs
6.1.0 <= v <= 6.1.019 CVEs
< 6.5.16.018 CVEs
<= 6.5.15.016 CVEs
6.0.0 <= v <= 6.0.016 CVEs
6.4 <= v <= 6.416 CVEs
6.2.0 <= v <= 6.2.015 CVEs
<= 6.5.13.014 CVEs
<= 2020.5.013 CVEs
<= 6.5.25.013 CVEs
6.3 <= v <= 6.313 CVEs
6.2 <= v <= 6.211 CVEs
6.3.0 <= v <= 6.3.011 CVEs
6.5.0.0 <= v <= 6.5.5.011 CVEs
6.4.0.0 <= v <= 6.4.8.110 CVEs
< 6.5.249 CVEs
<= 6.3.3.89 CVEs
6.3.0.0 <= v <= 6.3.3.89 CVEs
<= 6.4.8.18 CVEs
<= 6.5.10.08 CVEs
<= 6.5.23.08 CVEs
<= 6.5.5.08 CVEs
6.4.0 <= v <= 6.4.08 CVEs
< 6.5.21.07 CVEs
<= 2025.8.07 CVEs
<= 6.5.24.07 CVEs
< 2023.11.06 CVEs
< 2024.5.06 CVEs
<= 6.2 SP1-CFP206 CVEs
5.6.1 <= v <= 5.6.16 CVEs
6.2.0.0 <= v <= 6.2.0.06 CVEs
6.4 <= v < 6.4.8.16 CVEs
6.5 <= v < 6.5.5.06 CVEs
< 2025.55 CVEs
< 6.5.225 CVEs
6.5.22.0 <= v <= 6.5.22.05 CVEs
< 6.5.17.04 CVEs
<= 6.5.8.04 CVEs
<= 6.5.9.04 CVEs
< 6.5.14.03 CVEs
<= 6.2.03 CVEs
<= Forms SP5 add-on for AEM 6.5.5.03 CVEs
<= Forms SP8 add-on for AEM 6.4.8.13 CVEs
< 2024.032 CVEs
<= 6.1.02 CVEs
<= 6.2.1.202 CVEs
<= 6.4.02 CVEs
<= 6.4.8.32 CVEs
<= 6.5.7.02 CVEs
<= AEM Cloud Service2 CVEs
6.0 <= v <= 6.02 CVEs
6.1 <= v <= 6.12 CVEs
6.1.2.1 <= v <= 6.1.2.162 CVEs
6.2 <= v <= 6.52 CVEs
6.2.1.1 <= v <= 6.2.1.152 CVEs
6.3 <= v < 6.3.3.72 CVEs
6.4 <= v < 6.4.7.02 CVEs
6.4.0.0 <= v < 6.4.8.42 CVEs
6.5 <= v < 6.5.3.02 CVEs
6.5.0.0 <= v < 6.5.8.02 CVEs
< 6.5.18.01 CVE
<= 2.20.61 CVE
<= 2024.5.01 CVE
<= 4.9.21 CVE
<= 5.1.x1 CVE
<= 6.11 CVE
<= 6.21 CVE
<= 6.31 CVE
<= 6.3.01 CVE
<= 6.5.16.01 CVE
<= 6.5.171 CVE
<= 6.5.501 CVE
<= 6.5.6.01 CVE
>= AEM 6.1 and earlier1 CVE
>= AEM 6.2 and earlier1 CVE
>= AEM 6.3 and earlier1 CVE
6.0 <= v <= 6.41 CVE
6.1.0 <= v <= 6.5.01 CVE
6.2.0 <= v < 6.4.01 CVE
6.2.1.1 <= v <= 6.2.1.141 CVE
6.3.2.1 <= v <= 6.3.2.11 CVE
6.3.2.1 <= v <= 6.3.2.21 CVE
6.4.0.0 <= v <= 6.4.8.21 CVE
6.5.0 <= v < 6.5.3.01 CVE

Fixed in

6.5.23.0238 CVEs
2025.5.0234 CVEs
6.5.25.0161 CVEs
2024.5154 CVEs
6.5.21154 CVEs
6.5.24.0139 CVEs
2025.12.0115 CVEs
2026.8.0104 CVEs
2024.11.0100 CVEs
6.5.22.096 CVEs
6.5.20.060 CVEs
2024.3.058 CVEs
2026.5.057 CVEs
6.544 CVEs

Find a version

1,269 CVEs

Sort

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-71357
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (17th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-75678
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (17th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-71565
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.2% (9th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-75687
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (17th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-75672
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (17th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-75734
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (20th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-75706
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (17th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-75730
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (20th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-75719
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (17th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-75707
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (17th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-75690
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (17th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-75715
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (17th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2025-64838
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (20th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-75646
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.2% (9th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-75640
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.2% (9th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-75643
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.2% (11th pct)2026-09-08
Adobe Experience Manager | Improper Input Validation (CWE-20)
CVE-2026-75726
Patch
CWE-20
Low · CVSS 3.5
EPSS 0.4% (30th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-19612
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (17th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-75660
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.2% (9th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-19479
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (17th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-75735
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (20th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-75637
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (17th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-75705
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (17th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-75694
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (17th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-75741
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (20th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-75679
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (17th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2025-64830
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (20th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-75729
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (20th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-75685
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (17th pct)2026-09-08
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
CVE-2026-75677
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (17th pct)2026-09-08

Showing 30 of 1,269

Common weakness types

The CWE weakness categories most often found in Adobe experience manager CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Adobe experience manager CVEs were published each year.

2016

13

2017

6

2018

16

2019

19

2020

25

2021

11

2022

58

2023

217

2024

313

2025

377

2026

214

Other Adobe products

Browse vulnerabilities for other products by Adobe.

acrobat dc1,838 CVEs acrobat reader dc1,838 CVEs acrobat1,415 CVEs Acrobat Reader1,159 CVEs flash player1,084 CVEs Adobe Experience Manager928 CVEs Adobe Acrobat and Reader516 CVEs air415 CVEs

All Adobe vulnerabilities

Frequently asked questions

Common questions about Adobe experience manager vulnerabilities.

How many CVEs does Adobe experience manager have?: Adobe experience manager has 1,269 published CVE records since 2016.
How many Adobe experience manager CVEs are in CISA KEV?: None of Adobe experience manager's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for Adobe experience manager vulnerabilities?: Yes — 1 of Adobe experience manager's CVEs have a known public exploit.
Which versions of Adobe experience manager are affected?: 145 distinct Adobe experience manager versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Adobe experience manager CVEs?: Adobe experience manager's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-20 (Improper Input Validation), CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
How many critical Adobe experience manager vulnerabilities are there?: Adobe experience manager has 19 critical and 36 high-severity CVEs.
What is the average severity of Adobe experience manager CVEs?: The average CVSS base score across Adobe experience manager's scored CVEs is 5.5.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Adobe experience manager vulnerabilities

Monitor new Adobe experience manager vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

6.5.15.034 CVEs

2026.2.033 CVEs

6.5.16.018 CVEs

6.5.249 CVEs

6.5.21.07 CVEs

2023.11.06 CVEs

2024.5.06 CVEs

6.4.8.16 CVEs

6.5.5.06 CVEs

2025.55 CVEs

6.5.225 CVEs

6.5.17.04 CVEs

6.5.14.03 CVEs

6.5.3.03 CVEs

2024.032 CVEs

6.3.3.72 CVEs

6.4.7.02 CVEs

6.4.8.42 CVEs

6.5.8.02 CVEs

6.4.01 CVE

6.5.18.01 CVE