EUVD-2026-35618
GHSA-p73p-xq6p-r6qp
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
AnalysisAI
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which subsequently executes in any victim's browser upon visiting the affected page. Affected versions include AEM 6.5.24, LTS SP1, and 2026.04 and earlier. The scope-changed CVSS designation reflects the cross-context impact typical of stored XSS - compromising the victim's browser session rather than just the server-side application. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
Adobe Experience Manager (AEM) is an enterprise content management platform used for building and managing web content and digital assets. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input containing script tags or event handlers is stored server-side without adequate sanitization and later reflected into rendered HTML without proper output encoding. The CVSS Scope:Changed attribute confirms the exploit crosses the trust boundary from the AEM application context into the victim's browser context, enabling session hijacking, credential theft, or DOM manipulation. Affected CPE data from EUVD covers Adobe Experience Manager versions up to and including 2026.04, encompassing the 6.5.x Long Term Support branch (SP1) and the cloud/continuous delivery track.
RemediationAI
The primary remediation is to apply the patch or updated version documented in Adobe security advisory APSB26-56, available at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The exact fixed version number is not independently confirmed in the available input data beyond the advisory reference - consult the advisory directly to obtain the specific target version for your AEM track (6.5.x LTS or cloud continuous delivery). As a compensating control prior to patching, restrict write access to AEM form fields and authored content areas to the minimum set of trusted users, reducing the pool of accounts that could introduce stored payloads. Deploying a Web Application Firewall rule to inspect and block script injection patterns in form submissions can reduce exposure but carries a risk of false positives affecting legitimate content authoring workflows. Content Security Policy (CSP) headers configured to restrict inline script execution can limit the impact of any stored XSS that is not yet remediated, though AEM's rich authoring environment may require careful policy tuning to avoid breaking functionality.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today