Adobe Experience Manager: 33 records in one advisory

33 records announced together, published 2026-03-11, every one of them citing the same advisory.

The advisory

Every record in this batch cites https://helpx.adobe.com/security/products/experience-manager/apsb26-24.html. That is the CNA's own reference, held in the index, and it is why these records are on one page.

Every CVE we hold for Adobe

What the records offer

All 33 records publish a fixed version.

No record in this batch is listed by CISA in held sources.

Held sources describe every record in this batch identically. Nothing but the identifier and the publication time separates one from another here.

Most commonly mapped weakness across the batch: CWE-79 Cross-site Scripting (Stored XSS)…

What this page does not cover

Every record citing this advisory is on this page.

The batch is what one advisory announced. It is not every record sharing this weakness, this product or this mechanism, and nothing here is scoped to any estate.

Listed for shared announcement, not shared vulnerability. Each record here is its own finding with its own page, and fixing one does not address another.

CVE-2026-27223Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27224Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27225Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27226Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27228Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27229Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27230Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27231Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27232Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27233Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27234Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27235Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27236Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27237Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27239Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27240Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27241Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27242Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27244Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27247Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

CVE-2026-27248Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27249Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27250Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27251Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27252Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27253Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27254Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27255Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27256Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27257Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27262Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27265Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

CVE-2026-27266Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

33 records, read from the index as it stood on 2026-10-18. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.