What is the CVSS score of CVE-2026-47935?

CVE-2026-47935 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47935

EUVD-2026-35638 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-vhmh-54w3-m685

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:32 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

AnalysisAI

DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04 and earlier allows a low-privileged remote attacker to execute arbitrary JavaScript in a victim's browser by manipulating the DOM environment through a crafted webpage. The changed scope (S:C in CVSS) means successful exploitation can affect resources beyond the vulnerable component itself, enabling session hijacking or credential theft against AEM users. Exploitation requires user interaction - the victim must be social-engineered into visiting an attacker-controlled or injected URL - and no public exploit or CISA KEV listing exists at time of analysis.

Technical ContextAI

Adobe Experience Manager is a Java-based enterprise content management platform widely deployed for web publishing and digital asset management. DOM-based XSS (CWE-79) is a client-side vulnerability class distinct from reflected or stored XSS: the payload never reaches the server. Instead, attacker-controlled data (e.g., from the URL fragment, query string, or postMessage) flows through the browser's DOM into a dangerous JavaScript sink such as innerHTML, document.write, or eval without adequate sanitization. The CVSS scope-change indicator (S:C) confirms the injected script executes in a security context that can reach resources outside the originating AEM page - typically the authenticated user's session cookie, stored credentials, or same-origin data. The affected CPE range covers Adobe Experience Manager from 0 through 2026.04 per EUVD-2026-35638, encompassing the long-term support branch (6.5.24, LTS SP1) and the cloud-native 2026.x release line.

RemediationAI

The primary remediation is to apply the patch or service pack detailed in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. An exact fixed version number was not extractable from the available intelligence data, so administrators should consult the bulletin directly to identify the target patch level for their AEM release track (6.5.x LTS or 2026.x cloud). While patching is underway, compensating controls include deploying a Content Security Policy (CSP) header that restricts script execution to trusted origins, which can break DOM XSS payloads but may cause rendering issues in AEM components that rely on inline scripting - test in staging before production rollout. Additionally, restricting access to AEM Author environments to trusted networks via firewall or reverse proxy reduces the attacker pool to those with network-level access. User-awareness guidance to avoid clicking unsolicited AEM links provides a marginal but low-cost control given the UI:R requirement.