EUVD-2026-35711
GHSA-mfg4-6whx-795h
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
AnalysisAI
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, and 2026.04 and earlier enables a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user browses to the affected page, the script executes in their browser under a changed scope (S:C), meaning the injected payload escapes the attacker's own session context and impacts other users - enabling session hijacking, credential harvesting, or unauthorized AEM actions on their behalf. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
Adobe Experience Manager is an enterprise content management platform built on Java, Apache Sling, and OSGi, widely deployed for web content authoring and digital asset management. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): user-supplied input submitted through form fields is persisted to the AEM repository without adequate sanitization, then later rendered in victim browsers without proper output encoding. The CVSS vector attribute S:C (Scope Changed) is technically significant here - the injected script executes in the browser security context of a different user than the attacker, not merely within the attacker's own session, which is the defining characteristic of stored XSS with cross-user impact. Affected versions span the 6.5.x legacy line through the current cloud-native AEM 2026.04 release, indicating the vulnerable form field handling is present across multiple product generations. No CPE strings were included in the source data; exact component-level identification should be cross-referenced against APSB26-56.
RemediationAI
Apply the vendor-released patch per Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. An exact patched release version number was not extractable from the provided source data - consult APSB26-56 directly to identify the target upgrade version before deploying. As a compensating control prior to patching, restrict AEM content authoring and form field editing permissions to fully trusted, vetted users only, effectively eliminating the low-privileged attacker path (PR:L); note this may disrupt content workflows where external contributors require authoring access. Deploying a Web Application Firewall with XSS filtering rules in front of AEM can intercept common payload patterns but carries false-positive risk against legitimate rich-text content and should be validated in audit mode before enforcement. Configuring a strict Content Security Policy (CSP) header to block inline script execution provides meaningful defense-in-depth but requires review of existing AEM templates and third-party integrations to avoid breaking functionality before enforcement.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today