What is the CVSS score of CVE-2026-47977?

CVE-2026-47977 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47977

EUVD-2026-35625 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-v374-qf6h-3mhj

XSS Adobe

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:20 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user - including higher-privileged administrators - browses to the affected page, the injected script executes in their browser, potentially enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and scope-changed rating elevate real-world concern for multi-tenant AEM deployments.

Technical ContextAI

Adobe Experience Manager (AEM) is an enterprise-grade content management platform used for web content, digital asset management, and forms. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), the canonical stored XSS weakness class, meaning user-supplied input stored persistently in the application is later rendered without adequate output encoding or sanitization. The CVSS scope change (S:C) confirms that the JavaScript executes in a browser context outside the vulnerable component itself - typically the authenticated session of a victim user browsing the page - allowing the attacker to cross trust boundaries. Affected versions include the AEM 6.5.x legacy branch (through 6.5.24 and LTS SP1) and the AEM as a Cloud Service track through the 2026.04 release. No CPE string was provided in the source data, but the ENISA EUVD entry (EUVD-2026-35625) and the Adobe APSB26-56 advisory confirm the affected product scope.

RemediationAI

Apply the vendor-released patch documented in Adobe security bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The exact fixed build versions (service pack or Cloud Manager release) should be confirmed directly from that advisory, as no specific fix version was present in the source data provided for this analysis. For AEM as a Cloud Service deployments, Adobe typically pushes patches automatically via Cloud Manager - verify that auto-update pipelines are active and that the 2026.04 baseline has been superseded. For on-premises AEM 6.5.x, apply the corresponding service pack or cumulative fix pack identified in APSB26-56. As an interim compensating control, restrict AEM author environment access to the minimum set of trusted users to reduce the pool of low-privileged accounts that could inject payloads; note this does not remediate the vulnerability but reduces the attack surface. Content Security Policy (CSP) headers configured to restrict inline script execution can limit the impact of successful injection but may affect legitimate AEM functionality and should be tested thoroughly before deployment.