What is the CVSS score of CVE-2026-47981?

CVE-2026-47981 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47981

EUVD-2026-35601 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-8h42-wgcf-wfrq

XSS Adobe

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:19 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, and 2026.04 and earlier allows a low-privileged authenticated attacker to permanently inject malicious JavaScript into vulnerable form fields within the CMS. When any user - including administrators - browses the page hosting the tampered field, the injected script executes in their browser under the application's security context, with scope change (S:C) enabling impact beyond the originating component. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low attack complexity and broad AEM deployment surface make patching a priority for enterprise environments.

Technical ContextAI

Adobe Experience Manager is an enterprise content management system widely used for web publishing and digital asset management. CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) indicates the root cause: user-supplied input written to form fields is not adequately sanitized or encoded before being rendered back in the browser. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C confirms network delivery, low complexity exploitation, and crucially a changed scope - meaning the injected script executes in the context of the victim's browser session rather than being confined to the attacker's own session. This scope change is characteristic of stored XSS where persistent payload delivery crosses principal boundaries. The ENISA EUVD entry EUVD-2026-35601 corroborates affected version range as Adobe Experience Manager 0 through 2026.04.

RemediationAI

The primary remediation is to apply the patch detailed in Adobe security advisory APSB26-56, available at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The exact patched release version is not independently confirmed from the provided intelligence beyond the advisory reference - consult APSB26-56 directly for the specific target version for both the 6.5.x and cloud release tracks. If immediate patching is not feasible, a concrete compensating control is to restrict content authoring and form-field submission permissions to fully trusted users only, removing or tightening access for contributor-level or externally-sourced accounts - this directly eliminates the PR:L attack surface. Additionally, deploying a Web Application Firewall rule to detect and block common XSS payloads in AEM form submissions can reduce exploitation likelihood, though this is not a substitute for patching and may cause false positives on legitimate rich-text content. Note that scope-change XSS can be used to hijack administrator sessions, so administrative users should be advised not to browse untrusted content areas until the patch is applied.