What is the CVSS score of CVE-2026-47951?

CVE-2026-47951 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47951

EUVD-2026-35620 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-gwww-gmwc-4v9p

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:26 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in the browsers of other users - including higher-privileged ones - who subsequently visit the affected page. Affected versions span 6.5.24, LTS SP1, and 2026.04 and earlier. The CVSS Scope:Changed designation indicates that successful exploitation can impact components beyond the attacker's privilege boundary, elevating the practical impact of an otherwise medium-severity finding. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

Adobe Experience Manager (AEM) is an enterprise content management and digital experience platform used for authoring, managing, and delivering web content. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), where user-supplied input written to a form field is persisted to the data store and later rendered in page output without adequate sanitization or encoding. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) confirms the flaw is reachable over the network with low complexity, requires only low-level privileges to write the payload, requires a separate victim to trigger execution, and crosses a security scope boundary - consistent with a content-author-to-admin or content-author-to-visitor escalation pattern common in CMS platforms. EUVD-2026-35620 tracks this issue and lists affected versions as Adobe Experience Manager 0 through and including 2026.04.

RemediationAI

Consult and apply the fix detailed in Adobe security bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. An exact patched version number was not independently confirmed from the available intelligence data - the advisory should be treated as the authoritative source for fix version and installation instructions. As a compensating control where immediate patching is not feasible, restrict AEM author-tier access to only trusted, vetted internal users to eliminate the low-privileged write path required for exploitation; this limits blast radius but does not eliminate the vulnerability. Additionally, review and tighten AEM's content security policy (CSP) headers to reduce the impact of any injected scripts - note that CSP misconfiguration or overly broad directives common in AEM deployments may reduce its effectiveness as a control. Output encoding hardening within AEM's HTL/Sightly templates or custom components may serve as a secondary mitigation, though this requires development effort and testing.