EUVD-2026-35710
GHSA-27jf-v685-r7qh
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
AnalysisAI
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in the browsers of other users who visit the affected page. Affected versions span the 6.5.x branch (through 6.5.24), the LTS SP1 track, and the cloud-native 2026.04 release and earlier. The scope-changed CVSS rating reflects that the injected payload crosses the security boundary from the attacker's session context to arbitrary victim sessions, enabling session hijacking, credential harvesting, or UI redress attacks against higher-privileged users. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present.
Technical ContextAI
Adobe Experience Manager (AEM) is an enterprise content management platform built on Apache Sling and OSGi, widely deployed for web content authoring and digital asset management. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), meaning user-supplied input written to a form field is persisted in the AEM repository and later reflected into page output without adequate output encoding or Content Security Policy enforcement. The CVSS vector (AV:N/AC:L/PR:L) indicates that any network-reachable user with a low-privilege AEM account - such as a content author - can trigger the injection without special conditions. The S:C (Scope Changed) component confirms the vulnerability crosses the browser security boundary, affecting sessions belonging to users other than the attacker. Affected CPE covers Adobe Experience Manager versions up to and including 2026.04 per EUVD-2026-35710.
RemediationAI
The primary remediation is to apply the update referenced in Adobe security bulletin APSB26-56, available at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The advisory covers the 6.5.x Service Pack track, the LTS SP1 track, and the AEM as a Cloud Service 2026.04 release line; customers should apply the fix corresponding to their deployed version. An exact patched version number is not independently confirmed from the available input data - consult APSB26-56 directly for the precise target build. As a compensating control where immediate patching is not possible, restrict the 'Author' role to trusted internal users only and remove any self-registration or external contributor access to reduce the attacker's ability to satisfy the PR:L prerequisite. Additionally, deploying or tightening Content Security Policy headers on AEM publish instances reduces the blast radius of any XSS payload by blocking inline script execution and unauthorized data exfiltration endpoints. Note that CSP hardening may require regression testing against existing AEM components that rely on inline scripts.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today