What is the CVSS score of CVE-2026-47993?

CVE-2026-47993 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-47993

EUVD-2026-35631 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-2849-c7m4-86m6

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:14 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

AnalysisAI

DOM-based Cross-Site Scripting in Adobe Experience Manager (versions 6.5.24, LTS SP1, and 2026.04 and earlier) allows an authenticated low-privilege attacker to inject and execute malicious JavaScript in a victim's browser by luring them to a crafted webpage. The CVSS Scope:Changed designation (S:C) confirms the injected script can affect browser contexts beyond the vulnerable page itself, elevating potential impact beyond the C:L/I:L ratings alone suggest. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Adobe Experience Manager (AEM) is an enterprise-grade content management platform used widely for digital experience delivery. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) in its DOM-based variant, which is distinct from reflected or stored XSS: the attack payload never transits the server but instead flows from an attacker-controlled DOM source (e.g., window.location, URL fragment, document.referrer) into an unsafe sink (e.g., innerHTML, document.write, eval) entirely within client-side JavaScript. This means server-side input filtering provides no protection. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N indicates network-reachable exploitation with low complexity once the attacker controls a low-privilege account and can direct a victim to a crafted URL. The Scope:Changed flag is particularly significant for AEM, as successful exploitation within an authenticated CMS session could compromise higher-privileged browser contexts. Affected versions per ENISA EUVD-2026-35631 span the range 0 through 2026.04, including the 6.5.x LTS branch up to 6.5.24 and LTS SP1.

RemediationAI

Apply the update specified in Adobe Security Advisory APSB26-56, available at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html - consult this advisory directly to confirm the exact patched version for your deployment track (6.5.x LTS or cloud/2026.x). The precise fix version number is not included in the available input data and should not be assumed. As compensating controls where immediate patching is not feasible, restrict AEM author and contributor role assignments to explicitly trusted accounts only, reducing the pool of low-privilege identities an attacker could leverage (PR:L prerequisite) - note this may impact CMS workflows if contributor access is broad. Implementing a strict Content Security Policy (CSP) on AEM pages can limit JavaScript execution contexts and partially mitigate DOM XSS impact, but requires regression testing as AEM's rich authoring UI is CSP-sensitive. Web Application Firewall rules targeting XSS payloads are not reliable for DOM-based variants since the payload does not transit the server; do not rely on WAF alone as a substitute for patching.