What is the CVSS score of CVE-2026-47962?

CVE-2026-47962 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47962

EUVD-2026-35614 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-wfhj-wghp-m7x9

XSS Adobe

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:23 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04 and earlier allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user browses a page containing the poisoned field, the script executes in their browser - with scope change (S:C) meaning the injected payload can affect resources and sessions beyond the origin of the vulnerable component itself. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Adobe Experience Manager is a Java-based enterprise content management system (CMS) used for web content authoring, digital asset management, and form workflows. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), meaning user-supplied input written to persistent storage is later rendered in page output without adequate sanitization or encoding. The CVSS scope-change indicator (S:C) is significant: it reflects that the injected script executes in the security context of the victim's browser session, potentially accessing cookies, tokens, or data governed by a different trust boundary than the vulnerable field itself. Affected CPE scope per EUVD covers Adobe Experience Manager versions up to and including 2026.04, spanning both the legacy 6.5.x line and the cloud-native LTS track.

RemediationAI

Refer to Adobe security advisory APSB26-56 (https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html) for the official patch. A patch is available per the vendor advisory, though the exact patched release version was not independently confirmed from the available intelligence data - consult the APSB26-56 bulletin directly for the precise fix version applicable to your AEM track (6.5.x, LTS, or cloud). As a compensating control while patching is scheduled, restrict authoring and form-field write access to the minimum necessary set of accounts using AEM's permission model, reducing the pool of potential attackers who satisfy the PR:L prerequisite. Additionally, consider deploying a Web Application Firewall rule to detect and block stored script injection patterns at the AEM authoring tier. Note that WAF rules for stored XSS carry a risk of false positives in rich-text editor workflows common to CMS environments.