What is the CVSS score of CVE-2026-47975?

CVE-2026-47975 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47975

EUVD-2026-35615 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-42wv-6p73-g65w

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:21 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager (versions 6.5.24, LTS SP1, and 2026.04 and earlier) enables a low-privileged authenticated attacker to persistently inject malicious JavaScript into vulnerable form fields within the CMS. When any victim - potentially a higher-privileged editor or administrator - browses to the page containing the injected content, the script executes in their browser context, with scope change (S:C) indicating the impact crosses AEM's security boundary into the victim's browser. No public exploit identified at time of analysis, and this vulnerability is not currently listed in CISA KEV.

Technical ContextAI

Adobe Experience Manager is a Java-based enterprise content management platform widely used for web publishing, digital asset management, and form-driven content authoring. CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) is the root cause: AEM fails to sanitize or encode attacker-supplied input stored in form fields before rendering it to subsequent users. The CVSS vector's Scope:Changed (S:C) flag is significant - it confirms the vulnerability breaks out of AEM's application trust boundary and executes in the victim's browser context, enabling attacks against data and sessions that AEM itself does not control. Affected CPE aligns with Adobe Experience Manager ≤ 2026.04 per EUVD-2026-35615.

RemediationAI

Apply the patch documented in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The exact patched version number is not independently confirmed from the available intelligence - consult APSB26-56 directly to obtain the specific target version for your release track (6.5.x LTS or 2026.x cloud). As compensating controls prior to patching: restrict form field authoring permissions to the minimum required set of trusted users (reducing the pool of accounts that can inject payloads), and deploy a WAF rule to filter common XSS patterns on AEM form submission endpoints, noting this may break legitimate rich-text input and requires careful tuning. Implementing a strict Content Security Policy header on AEM author and publish instances will limit the browser-side impact of any injected scripts by restricting unauthorized script sources, though CSP alone does not eliminate the stored payload.