EUVD-2026-35610
GHSA-xx27-2xjj-44v9
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
AnalysisAI
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) versions up to and including 6.5.24, LTS SP1, and 2026.04 enables a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any victim user subsequently browses to the page hosting the injected content, the script executes in their browser - outside AEM's security boundary (CVSS S:C, scope changed) - enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
Adobe Experience Manager is an enterprise content management platform used for authoring, managing, and delivering web content at scale. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): user-supplied input written to form fields is persisted without adequate sanitization and subsequently rendered unsanitized into the DOM when the page is served to other users. The CVSS 'Scope Changed' (S:C) flag is technically significant here - it indicates the injected script executes in the victim's browser context, a separate security principal from the AEM application itself, enabling cross-principal attacks such as cookie theft or DOM manipulation beyond the AEM origin. EUVD-2026-35610 corroborates the affected range as AEM ≤ 2026.04. The attack vector is Network (AV:N) with Low complexity (AC:L), reflecting that no special network position is required and the injection mechanism is straightforward.
RemediationAI
Apply the patch referenced in Adobe security bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. Patch available per vendor advisory; however, no specific fixed version number (e.g., 6.5.25 or 2026.05) was confirmed from the available input data - consult APSB26-56 directly for the exact remediated release. As an interim compensating control, restrict write access to vulnerable form fields to the minimum required user roles, reducing the pool of accounts that could be used to inject payloads. Additionally, consider enabling Content Security Policy (CSP) headers in the AEM dispatcher or web tier to limit inline script execution - note this may break legitimate AEM authoring features and requires testing. Audit existing content in AEM repositories for suspicious script tags if compromise is suspected.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today