EUVD-2026-35636
GHSA-m966-rvw4-4qv3
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
AnalysisAI
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04 and earlier allows an authenticated low-privileged attacker to inject and execute malicious JavaScript within a victim's browser by manipulating client-side DOM processing. The CVSS scope change (S:C) indicates the exploit can break out of the originating page's security context, enabling session hijacking or cross-origin actions against higher-privileged users. No public exploit identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog.
Technical ContextAI
Adobe Experience Manager is an enterprise-grade content management system used for web, digital asset, and forms management at scale. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the DOM-based variant where client-side JavaScript reads attacker-influenced data from the DOM (e.g., URL fragment, document.referrer, or similar sources) and writes it back to the page without sanitization - bypassing server-side input filtering entirely. Unlike reflected or stored XSS, DOM XSS execution is entirely client-side, making it harder to detect via WAF or server-side logging. The CVSS scope change (S:C) signals that the injected script can affect browser contexts beyond the AEM page's origin, enabling theft of cookies scoped to parent domains or abuse of browser-stored credentials. No CPE strings were provided in the input data; affected versions are drawn from the EUVD entry (Adobe Experience Manager ≤ 2026.04) and the Adobe PSIRT advisory APSB26-56.
RemediationAI
Apply the vendor-released patch per Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. An exact fixed version number is not independently confirmed from the available input data beyond the advisory reference - consult APSB26-56 directly to identify the precise target version for your AEM track (6.5.x Service Pack, LTS, or AEM as a Cloud Service 2026.x release). If immediate patching is not possible, restrict AEM authoring and preview environments to known-trusted, authenticated users through network controls or VPN-gating, reducing the pool of potential attackers who could obtain the low-privilege account required (note: this does not eliminate the risk for existing authenticated users). Deploying or tightening a Content Security Policy (CSP) on AEM pages can limit the impact of DOM XSS by restricting inline script execution and allowed script sources; however, AEM's rich authoring components may require careful CSP tuning to avoid breaking legitimate editor functionality.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today