What is the CVSS score of CVE-2026-47985?

CVE-2026-47985 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47985

EUVD-2026-35639 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-jw3g-f53v-4p8x

XSS Adobe

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:17 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

AnalysisAI

DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, and 2026.04 and earlier allows an authenticated attacker to deliver a crafted webpage that, when visited by a victim, executes arbitrary JavaScript within the victim's browser context. The CVSS scope change (S:C) indicates impact crosses the security boundary of the vulnerable AEM component into the victim's browser session, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit identified at time of analysis; SSVC assessment marks exploitation as none and the attack as not automatable.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) manifests here as a DOM-based variant, meaning the vulnerability exists entirely client-side: attacker-controlled data is read from the DOM (e.g., URL fragment, document.location, or similar sources) and written back into the page without sanitization by AEM's JavaScript layer, bypassing server-side defenses. Adobe Experience Manager is a Java-based enterprise CMS/DAM platform built on Apache Sling and OSGi; its rich front-end rendering pipeline introduces numerous DOM sink/source pairs that, if unsanitized, create XSS vectors. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C confirms network delivery with low complexity, low privilege requirement, mandatory user interaction, and cross-context impact scope. Affected versions span the 6.5.x LTS line through 2026.04 cloud releases, per EUVD-2026-35639.

RemediationAI

Apply the update referenced in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The exact patched version number is not explicitly stated in the available intelligence beyond the advisory reference, so consult the bulletin directly to confirm the target upgrade version - the advisory should specify the minimum safe version for both the 6.5.x LTS line and the AEMaaCS 2026.x track. If immediate patching is not feasible, consider restricting access to AEM author and publish tiers to trusted, known-good users only, reducing the authenticated attacker surface (the PR:L vector means only authenticated users can initiate the attack). Additionally, implement Content Security Policy (CSP) headers on AEM-served pages to restrict JavaScript execution sources, which can mitigate DOM XSS impact even if the root cause is unpatched - note that misconfigured CSP may break AEM's own front-end components, so test thoroughly before deployment.