What is the CVSS score of CVE-2026-47957?

CVE-2026-47957 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47957

EUVD-2026-35610 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-xx27-2xjj-44v9

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:24 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager (AEM) versions up to and including 6.5.24, LTS SP1, and 2026.04 enables a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any victim user subsequently browses to the page hosting the injected content, the script executes in their browser - outside AEM's security boundary (CVSS S:C, scope changed) - enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Adobe Experience Manager is an enterprise content management platform used for authoring, managing, and delivering web content at scale. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): user-supplied input written to form fields is persisted without adequate sanitization and subsequently rendered unsanitized into the DOM when the page is served to other users. The CVSS 'Scope Changed' (S:C) flag is technically significant here - it indicates the injected script executes in the victim's browser context, a separate security principal from the AEM application itself, enabling cross-principal attacks such as cookie theft or DOM manipulation beyond the AEM origin. EUVD-2026-35610 corroborates the affected range as AEM ≤ 2026.04. The attack vector is Network (AV:N) with Low complexity (AC:L), reflecting that no special network position is required and the injection mechanism is straightforward.

RemediationAI

Apply the patch referenced in Adobe security bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. Patch available per vendor advisory; however, no specific fixed version number (e.g., 6.5.25 or 2026.05) was confirmed from the available input data - consult APSB26-56 directly for the exact remediated release. As an interim compensating control, restrict write access to vulnerable form fields to the minimum required user roles, reducing the pool of accounts that could be used to inject payloads. Additionally, consider enabling Content Security Policy (CSP) headers in the AEM dispatcher or web tier to limit inline script execution - note this may break legitimate AEM authoring features and requires testing. Audit existing content in AEM repositories for suspicious script tags if compromise is suspected.