EUVD-2026-35627
GHSA-6fvg-8qc4-qcmm
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
AnalysisAI
DOM-based Cross-Site Scripting in Adobe Experience Manager (versions up to and including 6.5.24, LTS SP1, and 2026.04) allows an authenticated low-privilege attacker to execute arbitrary JavaScript in a victim's browser by directing them to a crafted webpage. The scope-changed rating (S:C) indicates the injected script's impact escapes the vulnerable AEM component boundary, potentially compromising session data or other browser-accessible resources belonging to the victim. No public exploit code has been identified and no active exploitation is confirmed by CISA KEV at time of analysis.
Technical ContextAI
This is a DOM-based Cross-Site Scripting vulnerability (CWE-79) in Adobe Experience Manager (AEM), Adobe's enterprise content management platform widely used for marketing, digital assets, and authenticated content workflows. DOM-based XSS is mechanistically distinct from reflected or stored XSS: the server response may itself be benign, but client-side JavaScript dynamically writes attacker-controlled data into the DOM, causing the browser to execute the injected payload without a malicious server round-trip. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C places this firmly in the network-delivered, low-complexity category, but the PR:L component confirms the attacker must hold a valid low-privilege AEM account. The scope change (S:C) is significant for AEM deployments - it means the injected script can interact with components outside the vulnerable page's origin boundary, such as accessing session tokens usable across the AEM interface. Specific CPE strings were not provided in source data; affected version range per EUVD-2026-35627 covers all Adobe Experience Manager releases from 0 through 2026.04.
RemediationAI
Apply the vendor-released fix per Adobe Security Bulletin APSB26-56, available at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html - this bulletin covers the 6.5.24, LTS SP1, and 2026.04 release lines. The exact patched version number was not independently confirmed from the input data and must be verified directly in APSB26-56 before deployment. As a compensating control prior to patching, restrict AEM author and publish environments to trusted internal networks or VPN-enforced access, reducing the attacker's ability to deliver crafted URLs to authenticated users over the open internet. Implementing or tightening Content Security Policy (CSP) headers on AEM responses can constrain script execution scope and limit DOM-based XSS impact; however, AEM's authoring interface relies heavily on JavaScript and CSP tuning must be validated thoroughly in a staging environment to avoid breaking legitimate authoring functionality. User awareness training targeted at AEM-authenticated staff - particularly content authors and administrators - regarding phishing and crafted-link attacks is a secondary mitigation that directly addresses the UI:R prerequisite.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today