What is the CVSS score of CVE-2026-47950?

CVE-2026-47950 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47950

EUVD-2026-35611 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-w63g-64mc-rmxg

XSS Adobe

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:27 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager (AEM) 2026.04 and earlier allows an authenticated low-privileged attacker to permanently inject malicious JavaScript into vulnerable form fields within the CMS. When any user - including administrators - browses to the page containing the poisoned field, the script executes in their browser under AEM's origin, with scope change (S:C) enabling the attacker to affect browser context beyond AEM's own security boundary. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low access complexity and persistent nature of the payload make this a credible threat in multi-tenant or contributor-accessible AEM environments.

Technical ContextAI

Adobe Experience Manager is an enterprise-grade Web Content Management System (WCMS) widely deployed for digital asset management and web publishing. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), meaning user-supplied input written to vulnerable form fields is not properly sanitized before being persisted and subsequently rendered as HTML/JavaScript in a victim's browser. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C confirms network-reachable exploitation at low complexity, requiring a low-privileged authenticated account and triggering on victim page load. The Scope Changed (S:C) component is significant: it indicates the injected script can operate outside AEM's own security context, potentially targeting the victim's session across the domain. Affected versions span the AEM 6.5.x LTS line (through 6.5.24 LTS SP1) and the cloud-native AEM as a Cloud Service track through the 2026.04 release, as confirmed by EUVD-2026-35611.

RemediationAI

Apply the patch detailed in Adobe Security Bulletin APSB26-56, available at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The advisory is the authoritative source for the exact fixed build numbers across both the AEM 6.5 LTS and AEM as a Cloud Service tracks - no specific fixed version number was included in the source data provided for this analysis, so administrators should consult APSB26-56 directly to confirm the target upgrade version for their deployment tier. As a compensating control where immediate patching is not possible, restrict write access to form fields and editable page components to the minimum required set of trusted accounts, reducing the attacker's ability to reach vulnerable input surfaces. Additionally, enforce strict Content Security Policy (CSP) headers on AEM publish and author environments to limit script execution contexts, though CSP alone does not prevent injection and carries configuration complexity trade-offs. Monitor AEM author activity logs for unexpected content modifications in form components.