EUVD-2025-210868
GHSA-3f5m-34wc-wh3m
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-reachable DOM XSS; PR:L because attacker needs an AEM account to craft or host the payload; UI:R and S:C for browser-context scope change; no availability impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
AnalysisAI
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to manipulate client-side DOM processing and execute arbitrary JavaScript in a victim's browser session. Affected deployments span AEM 6.5 up to version 6.5.24, AEM 6.5 LTS up to SP2, and AEM as a Cloud Service up to release 2026.7.0. Exploitation requires convincing an authenticated victim to visit a specially crafted URL; scope is changed because the injected script runs in the victim's browser context outside the AEM application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis; Adobe has issued patches under advisory APSB26-98.
Technical ContextAI
Adobe Experience Manager (AEM) is a Java-based enterprise web content management and digital asset management platform. The vulnerability is classified as DOM-based XSS (CWE-79), meaning client-side JavaScript in the AEM front-end reads attacker-controlled data from the DOM environment (e.g., URL fragment, query parameter, or document.referrer) and writes it unsanitized to a sink such as innerHTML or document.write. Unlike reflected or stored XSS, this variant never passes through the server, making server-side input filtering ineffective. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C indicates the vulnerable component is network-reachable, requires only low-privileged AEM access to craft a working payload, and that successful exploitation escapes into the victim's broader browser context - enabling credential theft, session hijacking, or UI redirection within the victim's authenticated AEM session. Affected product lines are identified via the EUVD advisory: cpe for AEM 6.5 ≤6.5.24, AEM 6.5 LTS ≤SP2, and AEM as a Cloud Service ≤2026.7.0.
RemediationAI
The primary remediation is to upgrade to the versions specified in Adobe security advisory APSB26-98 (https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html): for AEM 6.5 on-premises, apply the patch that advances beyond 6.5.24; for AEM 6.5 LTS, apply SP3 or later; for AEM as a Cloud Service, ensure the environment has been updated past the 2026.7.0 release (cloud deployments are typically updated by Adobe automatically). Exact replacement version numbers were not independently confirmed from the input data and should be verified directly from APSB26-98 before deployment. As an interim compensating control, organizations should restrict the AEM Author environment to the corporate network or VPN to limit the attacker's ability to send crafted URLs to internal users, noting the trade-off that this does not eliminate risk if the attacker is already an authenticated internal user. Content Security Policy (CSP) headers can limit DOM XSS impact if AEM's publishing layer supports strict CSP configuration, though effectiveness depends on the specific sink involved.
More in Experience Manager
View allSitecore Experience Manager, Platform, and Commerce versions 9.0 through 10.4 contain a Zip Slip vulnerability that allo
Sitecore PowerShell Extensions through version 7.0 allows authenticated users to upload arbitrary files including ASPX w
Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, wh
Adobe Experience Manager versions 6.5.23.0 and earlier contain a deserialization of untrusted data vulnerability that al
Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 through 10.4.1 contain a hardcoded administr
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows r
Multiple Sitecore products allow remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remote
Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability. Rated critical severity (CVSS 9.8
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerabilit
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), S
An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Comme
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today