What is the CVSS score of CVE-2026-47942?

CVE-2026-47942 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47942

EUVD-2026-35617 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-ghx9-58mm-682c

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:30 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager (versions 6.5.24, LTS SP1, and 2026.04 and earlier) permits a low-privileged authenticated attacker to persistently inject malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. The CVSS scope change (S:C) indicates the injected script can impact browser contexts beyond AEM itself - enabling session hijacking, credential harvesting, or UI redress attacks against higher-privileged users such as administrators. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none with partial technical impact.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) describes a failure to sanitize user-supplied input before rendering it in a web page. In the stored (persistent) variant present here, the payload is written to the AEM content repository and re-executed every time the affected page is served, amplifying its reach compared to reflected XSS. Adobe Experience Manager is a Java-based enterprise CMS/DAM platform built on Apache Sling and OSGi; form field handling in its authoring UI or public-facing forms is the identified injection surface. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C confirms the attack is fully network-reachable, requires no special conditions beyond a low-privileged account, and that successful exploitation changes scope - meaning scripts can reach the victim's broader browser session, not just the AEM application origin. Affected versions span the 6.5.x LTS line through 6.5.24 SP1 and the cloud-native 2026.04 release, per both the NVD description and EUVD-2026-35617 (affected range: Adobe Experience Manager 0 ≤ 2026.04).

RemediationAI

The primary remediation is to apply the patch documented in Adobe security advisory APSB26-56, available at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The exact fixed version is not independently confirmed from the provided input data - consult APSB26-56 directly for the precise patched build applicable to your AEM track (6.5.x LTS or AEM as a Cloud Service). As a compensating control while patching, restrict write access to AEM form fields to the minimum required set of authenticated roles, reducing the pool of accounts that could be leveraged to inject payloads. Additionally, deploying a Web Application Firewall rule to detect and block common XSS payload patterns in AEM form submissions can reduce injection success rates, though this has the trade-off of potential false positives on rich-text content. Content Security Policy (CSP) headers scoped to the AEM domain can limit the damage from any injected script by restricting script sources, though implementing CSP in AEM without breaking authoring UI functionality requires careful testing.