DocumentationExperience Cloud KCS

Addressing security scan findings for Underscore.js and jQuery in Adobe Experience Manager

Last update: October 21, 2026

Adobe Experience Manager (AEM) 6.5.x security scans may report vulnerable versions of Underscore.js, such as 1.13.4 affected by CVE-2026-27601, and jQuery 1.12.4 in AEM client libraries, particularly with AEM Forms or related add-ons. The source states that the Underscore.js vulnerability is addressed in later service packs and that the jQuery finding is a false positive in this context. To resolve the issue, verify the detected libraries and versions, upgrade to the latest service pack when required for Underscore.js, assess the jQuery finding, and verify the remediation by running the security scan again.

Description description

Environment

Adobe Experience Manager (AEM) 6.5.x (including LTS SP2 and SP3)

Issue/Symptoms

  • Security scans report detection of Underscore.js version 1.13.4 (CVE-2026-27601).
  • Security scans report detection of jQuery version 1.12.4 with multiple vulnerabilities.

Root cause

Outdated versions of Underscore.js and jQuery may be present in certain AEM client libraries. The source states that the Underscore.js vulnerability is addressed in later service packs and that the jQuery finding is a false positive in this context.

Resolution resolution

Follow the steps below to resolve the issue:

  1. Identify the detected versions:

    • Review the security scan results to determine the exact file paths and versions of Underscore.js and jQuery reported as vulnerable.
    • Check common locations, including client libraries under /libs or /apps, especially in AEM Forms add-ons.

  2. Verify the Underscore.js version:

    • If the environment is AEM 6.5 LTS SP3 or later, Underscore.js 1.13.8 or higher is already included, and the vulnerability is remediated.
    • If you’re on an earlier version, such as LTS SP2, plan to upgrade to the latest service pack to receive the fix for CVE-2026-27601.
    • If you can’t upgrade immediately, document the affected file paths for internal tracking and remediation planning.

  3. Assess the jQuery finding. The reported vulnerability for jQuery 1.12.4 in this context is a known false positive. No action is required unless the security scan provides additional, actionable details specific to your implementation.

  4. Share the scan results and the findings above with your internal security team to confirm that the remediation steps meet your organization’s requirements.

  5. After upgrading to the latest service pack, run the security scan again to confirm that the reported Underscore.js vulnerability is resolved.

recommendation-more-help
experience-cloud-kcs-help-kbarticles