What is the CVSS score of CVE-2026-47987?

CVE-2026-47987 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47987

EUVD-2026-35717 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-3m8j-h5x7-7r3h

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:16 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

AnalysisAI

DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, and 2026.04 and earlier enables an authenticated remote attacker to inject and execute arbitrary JavaScript within a victim's browser session by manipulating the client-side DOM environment. The CVSS Scope:Changed rating confirms the vulnerability crosses the security boundary from the AEM application into the victim's browser context, enabling theft of session tokens, credential harvesting, or malicious redirects. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) in its DOM-based variant means the injection occurs entirely client-side: attacker-controlled data is written into the DOM via JavaScript without proper sanitization, bypassing server-side output encoding defenses. Adobe Experience Manager is an enterprise-grade CMS and Digital Experience Platform built on Apache Sling and OSGi, typically deployed at scale in corporate marketing and e-commerce environments. The affected version range per EUVD-2026-35717 covers all AEM releases up to and including 2026.04, encompassing both the legacy 6.5.x Long-Term Support line (at least through SP24) and the AEM as a Cloud Service track. The DOM sink receiving unsanitized input has not been identified in public disclosures, but the CVSS vector AV:N/AC:L confirms it is network-reachable with low attack complexity.

RemediationAI

Apply the update documented in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html; this advisory is the primary vendor-released fix reference. The exact patched build version was not independently confirmed in the provided intelligence data beyond the advisory pointer - consult APSB26-56 for the precise target version for both AEM 6.5 LTS and AEM as a Cloud Service tracks. If immediate patching is not feasible, restrict access to AEM authoring environments to trusted internal networks or VPN only, reducing attacker delivery surface for the required UI:R interaction step. Additionally, enforce strict Content Security Policy (CSP) headers on AEM publish and author tiers to limit script execution scope, noting that CSP headers may interfere with some AEM client-side components and should be tested before broad deployment. Since PR:L is required, auditing and reducing the number of active low-privilege accounts in AEM can further constrain attacker prerequisites.