What is the CVSS score of CVE-2026-47986?

CVE-2026-47986 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47986

EUVD-2026-35608 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-9cch-jhcg-25hw

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:17 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

AnalysisAI

DOM-based Cross-Site Scripting in Adobe Experience Manager (versions 6.5.24, LTS SP1, 2026.04 and earlier) enables an authenticated attacker to inject malicious JavaScript into a victim's browser by manipulating the client-side DOM environment. The CVSS scope change (S:C) confirms the injected script can affect browser context beyond the AEM application boundary - a hallmark of XSS elevation into session hijacking or admin pivot. Exploitation requires low-privilege authenticated access and user interaction; no public exploit identified at time of analysis and this vulnerability is not listed in CISA KEV.

Technical ContextAI

DOM-based XSS (CWE-79) is distinct from reflected or stored XSS in that the malicious payload is processed entirely by the browser's DOM engine - it never transits the server, making server-side input validation ineffective as a sole control. Adobe Experience Manager is an enterprise Java-based CMS built on Apache Sling and OSGi, widely deployed for digital marketing and web content delivery. The vulnerability arises from client-side JavaScript in AEM that writes attacker-influenced data (e.g., URL fragments, query parameters, or DOM properties) directly into the page without sanitization. The CVSS vector S:C (scope changed) is characteristic of XSS vulnerabilities where script execution crosses the vulnerable component's security boundary into the broader browser session context. ENISA EUVD-2026-35608 corroborates the affected range as Adobe Experience Manager versions 0 through 2026.04. No explicit CPE strings were provided in the available intelligence.

RemediationAI

Apply the patch documented in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html and upgrade to the fixed version specified therein. The exact patched release version is not independently derivable from the available reference data - the APSB26-56 advisory must be consulted directly for the specific target version. While patching, restrict AEM author and publish environments to trusted internal networks or VPN-only access, reducing the pool of authenticated users who can deliver crafted payloads to victims. Deploying or tightening Content Security Policy (CSP) headers on AEM instances can block inline script execution resulting from DOM XSS; note that AEM's rich authoring interface may require careful CSP tuning to avoid breaking legitimate functionality - test in staging before production rollout. User awareness guidance for AEM administrators and editors to avoid clicking unsolicited links within the platform is a low-cost compensating control that directly addresses the UI:R exploitation requirement.