What is the CVSS score of CVE-2026-47989?

CVE-2026-47989 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47989

EUVD-2026-35626 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-m875-cq8m-c6gc

XSS Adobe

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:16 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

AnalysisAI

DOM-based Cross-Site Scripting in Adobe Experience Manager (versions 6.5.24, LTS SP1, and 2026.04 and earlier) allows an authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. The CVSS scope change (S:C) confirms the injected script executes in the victim's browser context - separate from the vulnerable AEM application - enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. Exploitation requires low privileges (authenticated attacker) and user interaction (victim must visit a crafted webpage); no public exploit identified at time of analysis.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) manifesting specifically as a DOM-based variant, meaning the vulnerability exists entirely in client-side JavaScript: attacker-controlled data from a DOM source (such as URL fragment, document.referrer, or window.location) is read by AEM's frontend scripts and written to a dangerous sink (e.g., innerHTML, document.write, eval) without adequate sanitization. Unlike reflected or stored XSS, the server never processes the payload - it is executed directly in the browser. Adobe Experience Manager is an enterprise-grade Content Management and Digital Experience Platform (DXP) running complex client-side JavaScript for content authoring and delivery workflows. Affected CPE aligns with Adobe AEM versions through 6.5.24, LTS SP1, and the 2026.04 cloud release as confirmed by EUVD-2026-35626.

RemediationAI

Patch available per Adobe vendor advisory APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. Exact fixed version numbers are not specified in the provided intelligence data - consult APSB26-56 directly for the specific patched build applicable to your AEM release track (6.5.x on-premise or cloud service 2026.x). If immediate patching is not feasible, compensating controls include: restricting access to AEM author and publish environments to trusted IP ranges to reduce the attacker surface for crafted link delivery; enforcing a strict Content Security Policy (CSP) header on AEM responses to block inline script execution and limit the impact of DOM XSS - note this may break legacy AEM UI components that rely on inline scripts and requires testing; and implementing user awareness measures to reduce the likelihood of victims following crafted links from untrusted sources. None of these workarounds eliminate the underlying vulnerability and patching remains the definitive fix.