What is the CVSS score of CVE-2026-47945?

CVE-2026-47945 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47945

EUVD-2026-35641 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-3j86-86g5-p9wj

XSS Adobe

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:29 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, and 2026.04 and earlier allows a low-privileged authenticated attacker to inject malicious scripts into vulnerable form fields, which then execute in any victim's browser when they navigate to the affected page. The Changed scope (S:C) in the CVSS vector confirms that impact escapes the vulnerable component and reaches the victim's browser context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize or encode user-controlled input before it is stored and subsequently rendered as HTML or JavaScript. Adobe Experience Manager is an enterprise-grade Content Management System (CMS) widely used for digital marketing and web content delivery. In this case, the vulnerable surface is one or more form fields within AEM's authoring or user-facing interface, where attacker-controlled input is persisted to the data store and later reflected into rendered pages without adequate output encoding. The Changed Scope designation in CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N is consistent with stored XSS, where the component that processes the exploit (the AEM backend) differs from the component that suffers the impact (the victim's browser). EUVD-2026-35641 corroborates affected versions as all AEM releases up to and including 2026.04.

RemediationAI

Adobe has published advisory APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html, which should be consulted for the exact patched release version. The available input data does not specify a confirmed fixed version number, so administrators should not infer a specific target version from this analysis alone - verify against APSB26-56 directly. As a compensating control pending patch application, restrict low-privileged user access to form fields and authoring components where untrusted input could be stored, and enforce strict Content Security Policy (CSP) headers to limit inline script execution in the browser, noting that CSP tuning in AEM may require testing to avoid breaking legitimate editor functionality. Additionally, review and audit recently submitted content in vulnerable form areas for signs of injected script tags.