EUVD-2026-35637
GHSA-j7gp-v4j4-93pc
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
AnalysisAI
Stored Cross-Site Scripting in Adobe Experience Manager (versions 6.5.24, LTS SP1, 2026.04 and earlier) allows a low-privileged authenticated attacker to permanently inject malicious JavaScript into vulnerable form fields. When any user - including higher-privileged administrators - browses to the page containing the tainted field, the script executes in their browser under a changed scope (S:C), meaning the impact extends beyond the originating application context. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the low attack complexity and broad version range make this a realistic internal threat in multi-tenant AEM environments.
Technical ContextAI
Adobe Experience Manager (AEM) is an enterprise-grade Web Content Management (WCM) platform built on Apache Sling and OSGi. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), meaning user-supplied input is persisted server-side and later rendered without adequate sanitization or output encoding in HTML context. The CVSS vector AV:N/AC:L/PR:L indicates the exploit path is network-accessible, straightforward to execute, and requires only a low-privilege account (e.g., a content author or contributor role). The S:C (Scope Changed) flag is significant: injected scripts can affect browser contexts beyond the AEM origin, potentially enabling session theft or credential harvesting against authenticated administrators. Affected versions per EUVD span all AEM releases up to and including 2026.04 (the EUVD range is expressed as 0 ≤ 2026.04), covering the legacy 6.5.x line (6.5.24), the LTS SP1 track, and the 2026.04 cloud release.
RemediationAI
The primary remediation is to apply the patch or updated release documented in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. An exact fixed version number was not included in the available input data - consult APSB26-56 directly to confirm the target build for your AEM track (6.5.x Service Pack, LTS SP, or AEM Cloud 2026.x). As a compensating control prior to patching, restrict the content authoring role assignments to only trusted users, reducing the pool of accounts that could inject payloads (trade-off: limits collaboration workflow). Additionally, enforce Content Security Policy (CSP) headers on AEM publisher and author instances to restrict inline script execution - this can break legitimate AEM UI components, so test thoroughly in staging. Web Application Firewall rules can be tuned to detect and block stored XSS payloads in form field submissions, though bypass techniques exist and this is not a substitute for patching. No indication of a workaround sufficient to fully mitigate this issue without patching was found in the available data.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today