What is the CVSS score of CVE-2026-47948?

CVE-2026-47948 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47948

EUVD-2026-35609 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-6mhj-v99h-479v

XSS Adobe

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:28 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, and 2026.04 and earlier enables a low-privileged authenticated attacker to persist malicious JavaScript in vulnerable form fields, executing in the browser of any user who subsequently views the affected page. The CVSS Scope Changed (S:C) designation confirms the injected script crosses trust boundaries, meaning payloads can target administrator sessions, exfiltrate tokens, or perform privileged actions beyond the AEM application context. Adobe has published advisory APSB26-56 addressing this issue; no public exploit has been identified at time of analysis.

Technical ContextAI

Adobe Experience Manager is an enterprise content management system used for web content authoring, digital asset management, and form creation. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient sanitization or encoding of user-controlled input before it is rendered into HTML output. The stored variant of XSS is particularly significant in a CMS context: the payload is persisted in the application's datastore and executes automatically for every user who browses the affected page, without requiring repeated attacker interaction. The CVSS vector component S:C (Scope Changed) confirms the vulnerability crosses security boundaries - scripts can operate in browser contexts beyond AEM itself, enabling attacks on session state, cookies, or connected systems accessible from the victim's browser. No CPE strings were supplied in the available data; affected product identification is based on version ranges from the Adobe PSIRT disclosure and EUVD-2026-35609.

RemediationAI

Consult Adobe security advisory APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html for the specific patched release and installation instructions - the exact fix version was not independently confirmed from the available data and should not be inferred. As a compensating control pending patching, restrict content authoring and form-editing permissions within AEM to only fully trusted internal users, since exploitation requires a low-privileged authenticated account with write access to form fields; reducing the pool of accounts with that capability directly limits exposure. Deploying a strict Content Security Policy (CSP) on AEM-served pages - specifically restricting inline script execution - can limit the damage from any injected payload, though this may conflict with AEM's default use of inline scripts and requires testing before production rollout. Enabling AEM's built-in XSS protection filters and reviewing output encoding configurations in affected form components provides additional defense-in-depth while the patch is applied.