EUVD-2026-35719
GHSA-67jr-5ggx-cm8x
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
AnalysisAI
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, and 2026.04 and earlier allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by manipulating the Document Object Model. The CVSS Scope:Changed rating signals that successful exploitation breaks out of the vulnerable component's security boundary, enabling impact on resources beyond AEM itself - such as adjacent browser sessions or stored credentials. No public exploit identified at time of analysis, and CISA KEV listing is absent, but the low attack complexity and changed scope make this a meaningful risk for organizations running AEM with untrusted low-privilege users.
Technical ContextAI
DOM-based XSS (CWE-79) is distinct from reflected or stored XSS in that the vulnerability exists entirely in client-side JavaScript logic: attacker-controlled data is written into the DOM and then read and executed by other client-side scripts without adequate sanitization, without the server ever seeing or reflecting the malicious payload. The affected product is Adobe Experience Manager - a Java/OSGi-based enterprise CMS - across the 6.5.x LTS branch (up to 6.5.24 and LTS SP1) and the cloud-native 2026.04 release and earlier. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N characterizes a network-reachable, low-complexity attack requiring only low privileges, user interaction, with scope change and limited confidentiality/integrity impact. The scope change (S:C) is technically significant: it indicates the injected script operates in a security context different from the vulnerable AEM component, consistent with script execution affecting the broader browser origin.
RemediationAI
Consult and apply the guidance in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html - this is the authoritative source for exact patched versions across both the 6.5.x LTS and 2026.x cloud release tracks. The exact fixed version numbers are not independently confirmable from the available intelligence data and must be retrieved directly from APSB26-56. As a compensating control pending patching, restrict AEM Author environment access to trusted internal networks and authenticated users only, reducing the attacker's ability to deliver a crafted payload to a privileged victim. Disabling or filtering HTML/JavaScript input in AEM authoring components may reduce attack surface but can break legitimate content-authoring workflows and should be evaluated carefully. Content Security Policy (CSP) headers on AEM-served pages can limit the damage of injected scripts by restricting script sources and preventing exfiltration to attacker-controlled domains - a viable defense-in-depth measure with low operational side-effects.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today