What is the CVSS score of CVE-2026-47970?

CVE-2026-47970 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47970

EUVD-2026-35612 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-m3rg-6qxm-2p2g

XSS Adobe

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:23 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager (versions 6.5.24, LTS SP1, and 2026.04 and earlier) enables low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of users who visit the affected pages. The CVSS Scope:Changed designation means injected scripts can breach the security context of the AEM application itself, potentially affecting other browser-accessible resources. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Adobe Experience Manager (AEM) is an enterprise-grade content management system used for web authoring, digital asset management, and form-based workflows. CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) indicates that user-supplied input submitted through form fields is persisted server-side without adequate output encoding or sanitization, and is later rendered directly into page HTML delivered to other users' browsers. The CVSS vector's S:C (Scope Changed) flag is significant: it indicates the injected script executes in a browser security context that extends beyond the AEM application boundary, meaning the attacker's JavaScript can interact with other origins or resources accessible to the victim's browser session. Affected versions span the AEM 6.5.x legacy line (up to 6.5.24), the LTS SP1 branch, and the cloud-native 2026.04 release and earlier, as confirmed by EUVD-2026-35612.

RemediationAI

Apply the patch detailed in Adobe security bulletin APSB26-56, available at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The advisory is the authoritative source for exact patched version numbers; a specific fixed release version was not independently confirmed from the available intelligence data beyond the advisory reference. As a compensating control pending patching, restrict low-privileged author access to form field components identified as vulnerable - this limits the attacker's ability to plant payloads but may disrupt legitimate content authoring workflows. Additionally, Content Security Policy (CSP) headers configured to block inline script execution can reduce the impact of stored XSS if triggered, though misconfigured CSP on AEM is common and should be validated before relying on it as a control. Enforcing least-privilege account provisioning for AEM authors reduces the pool of potential attackers.