Adobe FrameMaker 2026 (builds up to and including 18.0.0.206) and FrameMaker 2022 (builds up to and including 17.0.9.866) contain an out-of-bounds read that allows an attacker to disclose sensitive contents of process memory when a victim opens a specially crafted document. Exploitation is strictly local and depends on user interaction - the victim must open the malicious file - and the resulting impact is limited to information disclosure, with no code execution or system compromise (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 5.5). No public exploit code has been identified at time of analysis and there is no indication of active exploitation, making this a low-urgency issue requiring remediation through the vendor advisory rather than emergency action.
Denial of service in Adobe FrameMaker 2022 (versions ≤ 17.0.9.866) and FrameMaker 2026 (versions ≤ 18.0.0.206) allows an attacker to crash the application by crafting a document that triggers a NULL pointer dereference when the victim opens it. The vulnerability is local in nature (AV:L) and requires user interaction (UI:R) - the victim must actively open the malicious file - with no authentication or privileges required (PR:N), and only availability is impacted while confidentiality and integrity remain unaffected. No public exploit code has been identified and there is no indication of active exploitation (not listed in CISA KEV) at time of analysis, making this a moderate-severity, low-priority issue despite the 5.5 CVSS base score.
A NULL pointer dereference in Adobe Photoshop Desktop crashes the application when a victim opens an attacker-supplied file, producing a local denial-of-service condition with no confidentiality or integrity impact. Affected builds are the 27.x track through 27.10 and the 26.x track through 26.11.7, covering both the current and previous release branches. The attack vector is local (AV:L) and requires the user to open the crafted file (UI:R), with no authentication relationship required on the attacker's side (PR:N); no public exploit has been identified at time of analysis, and no EPSS score or KEV listing was provided.
Guest-triggered denial of service in Xen Hypervisor lets unprivileged code inside an HVM or PVH guest crash that guest by forcing a VMentry failure; only hosts using Intel, VIA, or Zhaoxin VMX hardware virtualization are exposed, while AMD, Hygon and Arm hosts and PV guests are unaffected. Exploitation requires a high-complexity, precisely arranged CPU state (an intercepted #DB while single-stepping, execution blocked by STI/MovSS, and branch tracing enabled), it is confined to the attacker's own guest rather than the host or other guests, and no public exploit identified at time of analysis. Per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) this is a low-priority, guest-confined availability issue affecting all Xen versions on VMX platforms.
Xen 4.22 hosts running the C implementation of xenstored (as daemon or stubdom) can have the entire Xenstore service crashed or returned with corrupted data when an unprivileged guest holds a Xenstore watch with a specified watch depth and the host performs a Xenstore live update, producing a host-level denial of service for further domain administration actions. The root problem is that the watch state record is serialized two bytes short, so the newly booted xenstored misreads the record and faults. Exploitation is heavily gated on operator behavior - it requires Xen 4.22 plus C xenstored, a guest-registered watch with a stated depth, and an actual live update occurring while that watch is live - consistent with the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H; no public exploit code exists and the issue is not in CISA KEV, with no EPSS or POC signals present in the available data. Only Xen 4.22 with C xenstored is affected; Xen 4.21 and earlier and installations using oxenstored are not vulnerable.
Sensitive process-memory disclosure in Adobe Dimension 4.1.8 and earlier is triggered when a victim opens an attacker-crafted file, allowing an unauthenticated attacker to read out-of-bounds memory contents. The flaw is local (AV:L) and requires user interaction (UI:R) - the attacker must socially engineer the target into opening a malicious file on their own machine; there is no remote or automatic trigger. Impact is limited to confidentiality (C:H) with no code execution, data modification, or denial of service, EPSS/KEV status is negative, and no public exploit code has been identified at time of analysis, so this is a moderate-priority file-parsing issue rather than a top-tier emergency.
An out-of-bounds read (CWE-125) in Adobe Bridge allows disclosure of sensitive memory contents when a victim opens a specially crafted file in the application. Affected releases are Adobe Bridge 15.1.8 and earlier and 16.0.7 and earlier (per EUVD); the flaw is locally triggered (AV:L), requires no attacker authentication (PR:N), but mandates user interaction (UI:R) since the victim must open the malicious file, and its impact is limited to confidentiality (C:H with no integrity or availability effect) for a CVSS 3.1 base score of 5.5. There is no CISA KEV listing and no public exploit code identified at time of analysis, and Adobe's PSIRT published advisory APSB26-167 for this issue.
An out-of-bounds read in Adobe Substance 3D Designer 16.0.4 and earlier (CVE-2026-103825, CWE-125) can expose contents of sensitive memory when a victim opens a maliciously crafted file, resulting in information disclosure. The vector (AV:L/AC:L/PR:N/UI:R) confirms exploitation is local and requires user interaction - the attacker cannot trigger the flaw remotely and no authentication is needed per PR:N, but a crafted file must be opened by the target user. Impact is limited to confidentiality (C:H) with no integrity or availability effect, and no public exploit code has been identified at time of analysis; EPSS/KEV data was not provided, and this is assessed as a moderate-severity, low-priority issue rather than an urgent threat.
An out-of-bounds read in Adobe Substance 3D Designer 16.0.4 and earlier can disclose sensitive contents of process memory when a user opens a specially crafted file, yielding a moderate-severity information disclosure (CVSS 5.5, CWE-125). The attack is local-only and cannot be triggered remotely: it requires the victim to interact with the application by manually opening an attacker-controlled file, and there is no privilege or authentication prerequisite on the attacker's side. No public exploit code or confirmed active exploitation was identified at time of analysis, and because the leaked data is limited to the application's in-process memory - which the attacker must still find a way to recover - this should be handled as a routine patch-cycle priority rather than an emergency response.
Opening an attacker-crafted file in Adobe Substance 3D Sampler 6.0.3 and earlier can trigger an out-of-bounds read that discloses sensitive contents of the application's process memory to the attacker. The vulnerability is local in nature (AV:L) and requires the victim to manually open a malicious file (UI:R), so it cannot be triggered remotely or without user interaction; impact is limited to confidentiality, with no integrity or availability effect and no code execution claimed. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 3.1 base score of 5.5 reflects a genuine but moderate-priority information-disclosure issue rather than a high-urgency one.
Importing a specially crafted asset file into Adobe Substance 3D Sampler 6.0.3 or earlier can trigger an out-of-bounds read that leaks contents of the application's process memory to the attacker. The vulnerability is local in nature - there is no network or unauthenticated path to trigger it - and it is gated on user interaction, requiring the victim to be socially engineered into opening a malicious file; the outcome is limited to information disclosure with no integrity or availability impact and no code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is assessed as genuinely moderate risk rather than a top-tier priority.
Opening a maliciously crafted asset file in Adobe Substance 3D Stager 3.1.8 and earlier can trigger an out-of-bounds read that discloses sensitive contents of process memory to the attacker. Exploitation requires local file delivery plus a victim who actively opens the file (AV:L, UI:R), needs no application-level authentication (PR:N), and is confined to a confidentiality impact with no code execution, data modification, or denial of service. Rated 5.5 (medium) with no public exploit identified at time of analysis, this is a moderate-severity information-disclosure issue rather than an urgent-priority one.
A stack-based buffer overflow in Adobe Substance 3D Designer (versions 16.0.4 and earlier) allows an attacker to crash the application by supplying a crafted file that the victim opens, producing a denial-of-service condition for the active session. The attack is local (AV:L) and depends entirely on social engineering, since the victim must actively open the malicious asset (UI:R); no privileges are required (PR:N) and the impact is limited to availability with no confidentiality or integrity loss. Exploitation yields only an application crash rather than host compromise, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Opening a crafted file in Adobe Substance 3D Designer 16.0.4 and earlier can overflow a stack buffer and crash the application, giving an attacker a denial-of-service condition against a local user. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5, aligned with our independent assessment) confirms the trigger is a locally delivered file, requires the victim to manually open it, requires no privileges, and is scored purely for availability impact with no confidentiality or integrity loss; there is no network-reachable or unauthenticated-remote path. No public exploit code was identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV). This is a genuine but low-priority vulnerability whose realistic risk is constrained by the required user interaction, local file delivery, and crash-only impact.
Opening a crafted, attacker-supplied file in Adobe Photoshop triggers a NULL pointer dereference that crashes the desktop application, producing a local denial-of-service condition. The issue affects Photoshop builds up to and including 27.10 on the current branch and up to and including 26.11.7 on the prior branch; exploitation is gated entirely on social engineering because the victim must open the malicious file, and there is no code execution, privilege escalation, or confidentiality/integrity impact - only availability of the local application. No public exploit identified at time of analysis, and this is a genuine but modest-priority issue rather than a high-urgency flaw.
Application denial-of-service in Adobe Dimension 4.1.8 and earlier allows an attacker to crash the application by convincing a victim to open a specially crafted file on their local system. The flaw is a NULL pointer dereference in Dimension's file handling, so the impact is confined to availability of the application process itself - there is no code execution, no data exposure, and no effect on other systems or users. Exploitation is not automatable, requires the victim to voluntarily open the malicious file (UI:R) from a local vector (AV:L), and no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none.
Directory traversal in IBM WebSphere Application Server - Liberty (versions 17.0.0.3 through 26.0.0.9) lets a local, authenticated attacker who can deploy application archives write files outside the intended application directory by embedding crafted path entries in an archive. The attack is constrained rather than remote: the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (5.5), meaning the attacker must already hold local access and application-deployment privileges, and the only impact is integrity (file write) with no confidentiality or availability loss. This is a moderate-severity, low-urgency issue rather than a top priority; no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status.
Opening a crafted project or asset file in Adobe Substance 3D Designer 16.0.4 and earlier can crash the application, producing a denial-of-service condition on the user's workstation. The defect is a NULL pointer dereference (CWE-476) that is only reachable through mandatory user interaction - the victim must manually open the malicious file - and the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base score 5.5 MEDIUM) confirms the attack is local rather than network-reachable, requires no application credentials, and delivers availability impact only, with no confidentiality or integrity effect. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so the practical risk is limited to an application crash rather than code execution or data compromise.
Opening a specially crafted file in Adobe Substance 3D Designer 16.0.4 and earlier triggers a NULL pointer dereference that crashes the application, resulting in an application-level denial of service. The flaw is not remotely reachable: per the assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), an attacker must deliver a malicious file to the victim and convince them to open it locally, and the impact is limited to availability - no data disclosure, no file modification, and no code execution. This bounds the issue to moderate severity (CVSS 5.5); no public exploit code or confirmed active exploitation was identified at time of analysis, and Adobe has published vendor advisory APSB26-169 covering the affected product line.
Application denial-of-service in Adobe Substance 3D Designer 16.0.4 and earlier, where a NULL pointer dereference (CWE-476) triggers a crash when the application processes a specially crafted file. Exploitation requires a victim to actively open a malicious asset, so the attack is local in nature (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) - no attacker authentication is required, but the mandatory user action and the local vector sharply limit reachability to targeted social-engineering or supply-chain delivery of poisoned project files. Impact is limited to availability: there is no confidentiality or integrity loss and no evidence of code execution. There is no public exploit identified at time of analysis, and exploitation is not confirmed actively exploited (CISA KEV); overall this is a moderate-severity, low-priority issue best handled through routine patching of the affected build.
Opening a specially crafted file in Adobe Substance 3D Designer 16.0.4 and earlier can trigger a NULL pointer dereference that crashes the application, producing a denial-of-service condition. The flaw sits in the application's file/asset parsing path and is only reachable when a victim is persuaded to open an attacker-supplied file, so exploitation depends on user interaction (UI:R) on a local vector (AV:L) rather than any network-facing service. Impact is availability-only (A:H) with no confidentiality or integrity loss and no evidence of code execution; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, making this a moderate-severity (CVSS 5.5), lower-priority availability issue.
Opening a crafted file in Adobe Substance 3D Stager version 3.1.8 and earlier can trigger a NULL pointer dereference that crashes the application, resulting in a local denial-of-service condition. The issue is not remotely or automatically exploitable: the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) requires the victim to open an attacker-supplied file, and the impact is confined to availability with no loss of confidentiality or integrity, giving a base score of 5.5. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the CVE is not listed in CISA KEV; in practice this is a moderate-severity, low-priority issue that matters mainly where untrusted project or asset files are routinely opened.
Information disclosure in Mozilla Firefox for iOS (releases prior to 157.1) can leak saved credentials to a different origin: if a cross-origin navigation occurs while the saved-login/autofill UI is open, the browser may still fill the stored username and password into the newly loaded page, because the autofill action was never bound to the page that originally requested it and was not re-validated when the origin changed (CWE-346). Exploitation requires the user to have triggered the login prompt (UI:R) and depends on a narrow race between that prompt being open and the navigation occurring, so our independent assessment rates it as a network-reachable but high-complexity, unauthenticated issue with confidentiality-only impact (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N). No public exploit code has been identified at time of analysis, CISA's SSVC framework records exploitation as 'none' and the issue as not automatable, and Mozilla shipped the fix in Firefox for iOS 157.1.
Sandbox escape in asteval (the lmfit restricted Python expression evaluator) before 1.0.9 lets an attacker-controlled expression turn numpy's ndarray.ctypes wrapper into an arbitrary process-memory read/write primitive, which is equivalent to code execution and can also leak secrets or crash the host process. Exploitation requires the DEFAULT Interpreter with numpy enabled (the default whenever numpy is installed) and a host application that evaluates untrusted expression strings; per the assessed vector it is unauthenticated (PR:N) with no user interaction and needs no import, __dunder__ access, eval, or getattr. The headline is a sharp signal conflict: NVD-style scoring gives only 5.5 (AV:L/AC:L/PR:N/UI:R, availability-only), while the independent assessment scores the same flaw CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, so real-world risk depends entirely on how the consuming application exposes the evaluator. No public exploit code was identified at time of analysis, and the issue is fully remediated by upgrading to 1.0.9.
An out-of-bounds read in BlueZ's btmon Bluetooth monitoring utility, as packaged in Red Hat Enterprise Linux 6 through 10, allows an attacker to crash the tool by getting a user to open a crafted btsnoop capture file containing an HCI Return Link Keys event that advertises more link keys than the packet actually contains. The flaw is local-access and interaction-dependent (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - the victim must deliberately load the malicious capture into btmon - which sharply limits real-world exposure given btmon is a diagnostic tool rarely pointed at untrusted input. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical outcome is a denial of service against the monitoring utility rather than any network- or privilege-escalation impact.
Local, authenticated non-root users can bypass nosuid, nodev, and noexec mount restrictions enforced via /etc/fstab in BusyBox's mount utility by supplying clearing-mask options on the command line, potentially leading to integrity violations such as executing setuid programs or device access. The flaw requires a specific configuration where an fstab entry permits the user to mount a device and relies on those protections; it is not remotely exploitable. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is not provided.
Local information disclosure in Google Chrome's installer component on Windows (versions prior to 155.0.8059.79) allows an attacker who can already run a local program to obtain sensitive information via the installer path, though user interaction is required to trigger the vulnerable flow. Rooted in execution with unnecessary privileges (CWE-250) and rated 5.5 (moderate), the issue carries an EPSS score of 0.11% (1st percentile) and no public exploit identified at time of analysis; CISA KEV does not list it and the SSVC decision framework rates exploitation as none. Google has released a vendor patch in Chrome 155.0.8059.79.
A security-feature bypass in the Windows DHCP Server role allows an attacker who already holds low-privileged local access on the host to circumvent an authentication control, producing a high integrity impact while leaving confidentiality and availability unaffected. Exploitation requires local access to a machine running the DHCP Server role and a pre-existing authenticated foothold (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), so it cannot be triggered remotely or by an unauthenticated user. There is no public exploit identified at time of analysis - CISA's SSVC assessment records exploitation as "none" and automatable as "no" - and the vendor has released fixes, making this a genuinely moderate, low-urgency issue rather than a high-priority emergency. Affected platforms span Windows Server 2012 through Windows Server 2025 (including Server Core installations) plus Windows 10 versions 1607 and 1809.
Information disclosure in the Windows Servicing Stack allows an authenticated local attacker to trigger a buffer over-read and leak in-memory data on affected Windows 11 and Windows Server 2025 builds. The vulnerability requires local access and low-level privileges (PR:L) and has no remote or unauthenticated vector. No public exploit code has been identified, and CISA's SSVC assessment rates exploitation likelihood as none; the impact is limited to confidentiality with no integrity or availability effect.
Information disclosure in the Windows MIDI Service Module allows a locally authenticated low-privileged attacker to read sensitive system information outside their intended authorization sphere (CWE-497), affecting Windows 11 24H2, 25H2, 26H2 and 26H1 builds below 10.0.26100.9711, 10.0.26200.9711, 10.0.26300.9711 and 10.0.28000.3231 respectively. According to our independent assessment the issue is rated CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (5.5), meaning exploitation requires an existing low-privileged local session and interaction with the MIDI component; no victim user interaction is needed, but the attack cannot be performed remotely and therefore fits post-compromise or insider/standard-user scenarios rather than mass remote exploitation. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as none and the issue is not automatable, so this is a moderate-priority local information leak; vendor patches are available per Microsoft's advisory.
Weak authentication in the Windows Modern Device Management (MDM) component allows a locally authenticated, low-privilege user on Windows 10 Version 1809 or Windows Server 2019 (including Server Core) to tamper with device-management data and policy. Impact is integrity-only: there is no remote vector, no confidentiality loss and no denial of service, so exploitation requires an attacker to already hold a foothold on the host with a valid low-privilege account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Exploitation is assessed as none under the CISA SSVC framework, the issue is not in CISA KEV, and no public exploit code has been identified at time of analysis, but a vendor patch is available from Microsoft, making this a moderate-severity patch-cycle item rather than an emergency.
Information disclosure in Windows NFS Server (Windows Network File System) allows a locally authenticated attacker with low privileges to trigger an out-of-bounds read and potentially expose sensitive memory contents on affected Windows Server hosts. Exploitation requires the non-default NFS server role to be installed and running, and the CVSS vector (AV:L/PR:L) confirms local access and low privileges; there is no confirmed active exploitation or public exploit code identified at time of analysis, and the issue is rated CVSS 5.5 (moderate). Microsoft has released patches, so affected organizations should treat this as a routine but non-urgent update for NFS-enabled servers.
Information disclosure in Microsoft Office for Android (versions 16.0.1 prior to 16.0.20430.20000) allows a locally authenticated attacker to read uninitialized memory from the graphics component, potentially exposing sensitive data. The vulnerability requires local, low-privileged access (PR:L) and no user interaction, with a CVSS 3.1 score of 5.5 (moderate severity). No public exploit code has been identified at time of analysis, and the issue is not known to be actively exploited; patching to version 16.0.20430.20000 or later resolves the flaw.
Local information disclosure in Microsoft Defender for Endpoint for Windows arises from an out-of-bounds read that an authorized attacker with low-level privileges can trigger on a host to expose information from process memory. Only builds below 4.18.26060.3008 are affected, and the attack surface is strictly local (AV:L) with no user interaction required, so exploitation is confined to someone who has already gained a foothold on the target machine; the flaw yields only confidentiality impact (C:H) and cannot alter files, execute code, or crash the system (I:N/A:N). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the 5.5 CVSS score places this in moderate, non-emergency territory.
Server-side request forgery in conductor-oss Conductor through 3.33.0-rc10 allows unauthenticated remote attackers to induce the Agentspan Agent Runtime to make crafted requests to arbitrary URLs via AgentController.java (CWE-918). The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) limits impact to confidentiality only, and the CVSS 4.0 vector's E:P metric indicates publicly available exploit code exists; no CISA KEV listing or confirmed active exploitation was provided. Realistic risk is moderate and hinges on whether the Conductor instance is internet-facing and what internal services or cloud metadata endpoints are reachable from the server.
A remotely triggerable null pointer dereference in the Wavlink WL-WN592AX6 range extender's web management interface (firmware build 250422) allows unauthenticated attackers to crash the /cgi-bin/upload.cgi handler by sending a crafted Cookie header, resulting in a denial of service. Publicly available exploit code exists (no CISA KEV confirmation), and the CVSS 4.0 base score is 6.9, but our independent assessment rates the practical risk as low-to-moderate because these devices are typically confined to local networks and exploitation requires reachability to the management interface. There is no code execution or data disclosure; the impact is limited to availability of the CGI handler.
DOM-based cross-site scripting in Adobe Experience Manager 6.5 (through 6.5.25) lets an attacker who already holds low-privileged access to an AEM environment run arbitrary JavaScript in a victim's browser session after the victim is induced to visit a crafted page or URL (CVSS 5.4; AV:N/AC:L/PR:L/UI:R/S:C). Because the scope is changed, the executed script runs in the context of the victim's browser rather than inside the AEM server itself, but the mandatory user interaction and the PR:L precondition mean the issue cannot be triggered automatically or silently against a server. Aggregated signals indicate a low real-world priority: CISA's SSVC decision framework records Exploitation: none and Automatable: no, and no public exploit identified at time of analysis.
Reflected cross-site scripting in Adobe Experience Manager 6.5 LTS (up to and including 6.5 LTS SP3) and AEM 6.5 (up to and including 6.5.25) lets a low-privileged authenticated attacker run arbitrary JavaScript in a victim's browser session on the AEM origin by luring that victim to a crafted URL that references a vulnerable page. The vendor rates this CVSS 3.1 base 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting that successful exploitation requires both a valid low-privileged AEM account and victim interaction with an attacker-supplied link - a combination that materially limits automated or opportunistic abuse. There is no public exploit identified at time of analysis, and no CISA KEV or EPSS data was supplied with this report; the primary risk is session-context script execution against users who browse AEM author or publish pages while logged in.
Stored cross-site scripting in Adobe Experience Manager 6.5 (through 6.5.25) and AEM 6.5 LTS (through SP3) allows an authenticated, low-privileged user to persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any victim who later views the page rendering that content. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N for a base score of 5.4, meaning the attacker must hold a valid low-privileged account and the victim must actively browse to the injected page; the scope is changed because the script runs in the victim's browser context rather than the server's. Exposure is greatest on author or multi-tenant instances where content-contributor accounts are not fully trusted, and no public exploit identified at time of analysis - no CISA KEV entry or proof-of-concept code is present in the available intelligence, and no EPSS score was supplied.
Stored cross-site scripting in Adobe Experience Manager 6.5 (versions 6.5.0 through 6.5.25) allows an authenticated low-privileged attacker to inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who later views the affected page. The vulnerability carries a moderate CVSS base score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) and is rated CWE-79; exploitation requires both an existing low-privileged account to plant the payload and a victim to actively browse to the poisoned content, which keeps real-world risk measured rather than urgent. There is no public exploit identified at time of analysis, no CISA KEV listing, and Adobe has published a fix path via advisory APSB26-152.
Stored cross-site scripting in Adobe Experience Manager 6.5 (up to and including 6.5.25) and AEM 6.5 LTS (up to and including SP3) allows a low-privileged, authenticated author to plant malicious JavaScript inside vulnerable form fields so that it later executes in the browser of any user who browses to the page rendering that field. The vulnerable component is a classic CWE-79 input-neutralization failure in a content-management authoring surface, and the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C, 5.4) confirms the attacker must hold at least a low-privileged account and that a separate victim must interact with the poisoned page; anonymous external exploitation is not possible without such an account. Impact is bounded to confidentiality and integrity of the victim's session while scope is changed, meaning the injected script can affect resources outside the vulnerable component's security context; no public exploit identified at time of analysis and the KEV catalog does not list this CVE.
Stored cross-site scripting in Adobe Experience Manager 6.5 (up to and including 6.5.25) and AEM 6.5 LTS (up to and including LTS SP3) lets an authenticated low-privileged content author inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who browses to the affected page (CVSS 3.1 5.4, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Exploitation is gated by two limiters: the attacker must already hold an authoring/form-contributor account capable of writing into the affected field, and a separate victim must visit the poisoned page - so the flaw is not reachable by anonymous visitors and does not affect read-only default paths. No public exploit code has been identified at time of analysis and there is no indication of active exploitation; Adobe has published advisory APSB26-152 covering the fix.
Stored cross-site scripting in Adobe Experience Manager 6.5 (up to and including 6.5.25) lets an authenticated low-privileged attacker with authoring rights inject malicious JavaScript into form fields, which then executes in the browser of any user who later views the affected page. Exploitation requires both a low-privilege AEM account (PR:L) and victim interaction via a page visit (UI:R), and scope is changed (S:C) because the injected script runs in the victim's browser context. Rated CVSS 5.4 (moderate); no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Stored cross-site scripting in Adobe Experience Manager 6.5 (through 6.5.25) and AEM 6.5 LTS (through 6.5 LTS SP3) lets a low-privileged authenticated user persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any victim who views the page rendering that field (CVSS 5.4, CWE-79, scope changed). Exploitation requires a valid low-privileged authoring account (PR:L) and victim interaction (UI:R), so practical blast radius is bounded by the need for both an insider-level account and a victim browsing to the poisoned page. There is no public exploit code identified at time of analysis, no evidence of confirmed active exploitation (CISA KEV), and the CISA SSVC assessment rates exploitation as none and the issue as non-automatable, so real-world urgency is currently low despite the enterprise footprint of the product.
Stored cross-site scripting in Adobe Experience Manager (6.5 up to and including 6.5.25, and 6.5 LTS up to and including 6.5 LTS SP3) allows an authenticated, low-privileged author to inject malicious JavaScript into form fields so that it executes in another user's browser when that page is viewed. The flaw carries a moderate CVSS 3.1 base score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), meaning the attacker must already hold an AEM account with content-submission rights and a victim must navigate to the poisoned page, which materially limits exposure. There are no CISA KEV signals and no public exploit code identified at time of analysis, and the issue is constrained to the AEM 6.5 and 6.5 LTS branches.
DOM-based cross-site scripting in Adobe Experience Manager allows an authenticated, low-privileged user to craft a page or URL that runs arbitrary JavaScript in the browser context of a victim holding an active AEM session, which can expose session-related data and permit limited tampering with rendered page content. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (CVSS 5.4) means exploitation simultaneously requires the low-privilege precondition and successful social engineering of the victim, who must visit the crafted page, while the scope change reflects that the script executes in a context separate from the vulnerable component and the resulting impact stays at Low confidentiality and integrity with no availability effect. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the practical risk is concentrated in unpatched deployments, namely AEM 6.5 up to 6.5.25, AEM 6.5 LTS up to SP3, and AEM as a Cloud Service up to 2026.9.28187.
DOM-based cross-site scripting in Adobe Experience Manager lets a low-privileged authenticated attacker run arbitrary JavaScript in a victim's browser session by luring that user to a crafted page or URL that manipulates the client-side DOM (CVSS 5.4, scope changed). Exploitation is not automatic: it requires the PR:L privilege level noted in the CVSS vector plus victim user interaction, and impact is limited to the victim's browser context (C:L/I:L, no availability impact), so confidentiality and integrity effects outside the browser are not demonstrated. Affected deployments are AEM 6.5 through 6.5.25, AEM 6.5 LTS through SP3, and AEM as a Cloud Service through 2026.9.28187; no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, keeping this a moderate-severity, targeted-risk issue rather than an Internet-wide emergency.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.0 through 6.5.25 lets an attacker who holds a low-privilege authenticated account on the AEM instance execute arbitrary JavaScript in the browser of an authenticated victim who is induced to visit an attacker-crafted webpage, giving scope-changed access to that victim's browser session (low confidentiality and integrity impact, no availability impact). Exploitation requires both conditions to be met - a valid low-privilege account (CVSS PR:L) and victim interaction (CVSS UI:R) - which sharply limits drive-by or mass exploitation, and the effect is confined to the victim's browser session rather than the AEM server. CVSS 3.1 base is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis. Note the independent assessment flags a scoring discrepancy against the Adobe bulletin, so the authoritative base score should be verified against Adobe APSB26-152.
DOM-based cross-site scripting in Adobe Experience Manager 6.5 (through 6.5.25) lets an attacker with a low-privileged authenticated account on the instance execute arbitrary JavaScript in the browser of a victim who is induced to load a crafted page, potentially hijacking sessions and performing actions as that user in the AEM UI (scope change per CVSS S:C). Exploitation is not opportunistic: it requires both a valid low-privileged login (CVSS PR:L) and successful social engineering of a victim (CVSS UI:R), and impact is limited to confidentiality and integrity at Low with no availability effect (A:N). At CVSS 5.4 this is a moderate-severity, non-urgent finding - no public exploit code or confirmed active exploitation was identified at time of analysis - but it is worth prompt attention in environments where untrusted or guest-level AEM accounts are provisioned or where the author tier is broadly reachable.
DOM-based cross-site scripting in Adobe Experience Manager 6.5 through 6.5.25 allows an authenticated low-privilege attacker to execute malicious JavaScript in a victim's browser by luring them to a crafted webpage, potentially altering page content or accessing data visible to that victim. Exploitation requires both a foothold on the AEM instance (PR:L) and victim interaction (UI:R), and the scope change (S:C) reflects the potential for effects beyond the vulnerable component. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the vendor rates the issue as moderate severity (CVSS 5.4).