What is the CVSS score of CVE-2026-47980?

CVE-2026-47980 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47980

EUVD-2026-35642 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-p454-mq32-f8wx

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:19 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager (AEM) 6.5.24, LTS SP1, and 2026.04 and earlier allows a low-privileged authenticated attacker to inject persistent malicious scripts into vulnerable form fields within the CMS authoring interface. When a higher-privileged user such as an administrator subsequently browses to the page hosting the injected content, the JavaScript executes in their browser session under a changed security scope, enabling potential session hijacking or privilege escalation. No public exploit code or active exploitation confirmed by CISA KEV has been identified at time of analysis; Adobe has issued security advisory APSB26-56 addressing this issue.

Technical ContextAI

Adobe Experience Manager is a Java-based enterprise CMS platform used for web content authoring and digital asset management. The vulnerability is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), meaning user-supplied input in one or more form fields is persisted to the content repository and later rendered without adequate output encoding in downstream page views. The CVSS scope-change indicator (S:C) is the technically significant signal here: the injected script executes within the security context of whoever views the page, not the attacker's session, allowing the attacker to cross trust boundaries. EUVD-2026-35642 corroborates the affected range as AEM versions up to and including 2026.04. Specific vulnerable components or field types are not identified in the available data; the Adobe advisory APSB26-56 should be consulted for component-level detail.

RemediationAI

Apply the update specified in Adobe security advisory APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html - the exact fixed release version was not independently confirmed from the available input data and must be verified directly from that advisory. As a compensating control pending patching, restrict AEM authoring and content-submission permissions to a minimum set of trusted, identifiable user accounts, since exploitation requires a valid low-privileged account with write access to vulnerable form fields; removing or tightly scoping the Contributor or Author role for untrusted users directly eliminates the attack surface. Deploying a Web Application Firewall with XSS signature rules on AEM authoring endpoints can provide partial defense-in-depth, though WAF bypass is feasible for determined attackers and should not be treated as a primary mitigation. Content Security Policy (CSP) headers configured on AEM publish and author instances can limit the impact of script injection even if a payload is stored, by restricting script execution to trusted origins.