What is the CVSS score of CVE-2026-47947?

CVE-2026-47947 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47947

EUVD-2026-35623 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-27jh-p34j-6p8j

XSS Adobe

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:28 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

AnalysisAI

DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) versions up to and including 6.5.24, LTS SP1, and 2026.04 allows an authenticated low-privileged attacker to inject and execute arbitrary JavaScript within a victim's browser by manipulating the client-side DOM environment through a crafted webpage. Successful exploitation results in a scope change (S:C), meaning attacker-controlled script can reach resources beyond the vulnerable AEM component - such as session tokens or cross-origin content accessible to the victim. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, though Adobe's own PSIRT reported it under advisory APSB26-56.

Technical ContextAI

DOM-based XSS (CWE-79) differs from reflected or stored XSS in that the vulnerability exists entirely in client-side JavaScript: the page's own scripts read attacker-controlled data from the DOM (e.g., URL fragment, document.location, document.referrer) and write it back to the DOM without sanitization, never sending the payload to the server. Adobe Experience Manager is a Java-based enterprise CMS built on Apache Sling and OSGi; its rich client-side authoring interface relies heavily on JavaScript frameworks, making DOM-sink injection a plausible attack surface in UI components. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C confirms the attack is network-delivered, low complexity, requires a low-privileged AEM account to stage the malicious link, and changes scope - the injected script executes in the victim's browser session where it can access cookies, local storage, and perform authenticated AEM actions on behalf of the victim. Affected CPE is inferred from EUVD data as Adobe Experience Manager versions 0 through 2026.04 inclusive.

RemediationAI

The primary remediation is to apply the patch or upgrade documented in Adobe Security Bulletin APSB26-56 (https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html). The exact patched release version is not independently confirmed from the provided input data - consult APSB26-56 directly to identify the minimum fixed version for your AEM release line (6.5.x Service Pack, LTS SP1, or Cloud Service 2026.x). As a compensating control prior to patching, organizations can restrict access to AEM author and publish environments to trusted internal networks or VPN, reducing the attacker's ability to deliver crafted links to authenticated users. Content Security Policy (CSP) headers configured to restrict inline script execution can reduce the impact of DOM XSS payloads but may require tuning to avoid breaking AEM's JavaScript-heavy UI. Note that CSP is a mitigation, not a fix, and may introduce authoring workflow disruptions if not carefully scoped.