What is the CVSS score of CVE-2026-47966?

CVE-2026-47966 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47966

EUVD-2026-35607 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-8jff-x769-wx6g

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:23 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in other users' browsers upon page load. Affected versions span the 6.5.x branch through 6.5.24, the LTS SP1 track, and cloud-native releases through 2026.04. No public exploit code or active exploitation has been identified at time of analysis; however, the changed scope (S:C) elevates real-world impact by enabling session hijacking or credential theft against higher-privileged users such as authors or administrators.

Technical ContextAI

Adobe Experience Manager (AEM) is an enterprise content management and digital experience platform built on Apache Sling and OSGi. The vulnerability maps to CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), meaning user-supplied input is persisted server-side without adequate sanitization or output encoding and later rendered in the browser as executable script. The CVSS vector AV:N/AC:L/PR:L indicates the injection point is reachable over the network with low complexity, requiring only a low-privileged account (e.g., a contributor or author role). The S:C (Scope Changed) attribute signals that the exploit crosses a security boundary - from the attacker's session context into other users' browser contexts - which is characteristic of stored XSS where the injected payload executes under the victim's session. EUVD-2026-35607 corroborates affected product scope as all AEM releases up to and including 2026.04.

RemediationAI

Apply the patch detailed in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. An exact patched version number is not independently confirmed from the available data beyond 'versions after 2026.04' - consult the advisory directly to identify the correct update package for your track (6.5.x, LTS, or cloud). As a compensating control while patching is pending, restrict write access to AEM form fields and rich-text components to the minimum necessary accounts, reducing the attacker's ability to inject payloads. Additionally, enforcing a strict Content Security Policy (CSP) header that disallows inline script execution can mitigate impact if a payload is injected - note that AEM's built-in RTE components may require CSP tuning to avoid breaking legitimate functionality. Audit existing content for suspicious script tags if low-privileged contributor accounts are broadly provisioned.