What is the CVSS score of CVE-2026-47958?

CVE-2026-47958 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47958

EUVD-2026-35716 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-f8v6-6pj2-685r

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:24 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager (versions up to and including 6.5.24, LTS SP1, and 2026.04) allows a low-privileged authenticated attacker to persist malicious JavaScript in vulnerable form fields. When a victim - such as an administrator - browses a page containing the injected payload, the script executes in their browser session, enabling session hijacking, credential theft, or privilege escalation within the AEM instance. The CVSS Scope:Changed designation elevates practical risk above the medium base score of 5.4, as impact extends beyond the attacker's own session to the victim's browser context. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

Adobe Experience Manager is a Java-based enterprise content management system built on Apache Sling and OSGi. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), meaning the application fails to sanitize or encode user-supplied input before persisting it and later rendering it to other users' browsers. Unlike reflected XSS, the stored variant requires no per-victim delivery mechanism - the payload is embedded in the application's own content store. Both the legacy 6.5.x long-term support branch (through SP24) and the cloud-native 2026.x continuous release train (through 2026.04) are confirmed affected per the ENISA EUVD-2026-35716 entry and Adobe PSIRT advisory APSB26-56. The CVSS Scope:Changed (S:C) attribute confirms that the injected script executes in a distinct security principal's browser context, not just the attacker's own session.

RemediationAI

Apply the patch released by Adobe per security advisory APSB26-56, available at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. Exact fixed version strings were not present in the available source data and must be confirmed directly from APSB26-56 before deployment - do not rely on inferred version numbers. As a compensating control while patching is underway, restrict write access to AEM form fields and authored content to only fully trusted, vetted user accounts, eliminating the low-privileged attacker foothold required by PR:L; note this may block legitimate contributor workflows. Deploying WAF rules to inspect and block common XSS payload patterns on AEM authoring and publishing endpoints provides an additional layer, but carries a risk of false positives disrupting rich-text content authoring. Enforcing strict Content Security Policy (CSP) headers on AEM publish instances can limit the damage of injected scripts by restricting allowed script execution sources, though CSP configuration in AEM environments can be complex and requires testing to avoid breaking legitimate functionality.