What is the CVSS score of CVE-2026-47936?

CVE-2026-47936 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47936

EUVD-2026-35630 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-2w3v-cv29-rpc9

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:32 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored XSS in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04 and earlier allows a low-privileged authenticated attacker to persistently inject malicious JavaScript into vulnerable form fields via the AEM authoring interface. When any victim browses a page containing the compromised field, the injected script executes within their browser - the CVSS Scope Changed (S:C) flag confirms the impact crosses trust boundaries beyond the AEM application itself, enabling session theft or unauthorized actions on behalf of higher-privileged users. No public exploit identified at time of analysis; Adobe has published advisory APSB26-56 addressing this issue.

Technical ContextAI

Adobe Experience Manager is an enterprise-grade content management platform built on Apache Sling and OSGi, widely used for web content authoring and digital asset management. CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) arises when user-supplied content is persisted to AEM's content repository (JCR) and subsequently rendered in page output without adequate HTML encoding or sanitization. The CVSS vector AV:N/AC:L confirms the injection is deliverable remotely over the network with low attack complexity. The Scope Changed (S:C) attribute is technically significant: it indicates the injected script escapes the AEM application security context and executes in the victim browser's origin, potentially accessing cookies, session tokens, browser storage, or other cross-origin resources. EUVD-2026-35630 independently corroborates the affected version range as AEM ≤ 2026.04.

RemediationAI

Apply the fix documented in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. A vendor-released patch is referenced by APSB26-56, but the exact patched version number was not independently confirmed from available intelligence - consult the APSB26-56 bulletin directly for upgrade instructions specific to your AEM deployment track (6.5.x LTS or AEM as a Cloud Service). As a compensating control while patching, restrict form-field and rich-text authoring permissions to the minimum set of verified, trusted accounts, removing write access from external or low-trust users. Ensure AEM's built-in HTML sanitization policies (AntiSamy/XSSAPI) are active and enforced on all content-rendering components. Audit existing authored content for suspicious script injections. Note that tightening authoring permissions may disrupt legitimate content workflows and should be coordinated with content teams.