EUVD-2026-44381
GHSA-p74w-v7qc-5rmx
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-delivered DOM XSS requiring low-privilege authenticated attacker and victim click interaction; scope changes to browser context but impact limited to confidentiality and integrity at low severity.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
AnalysisAI
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated network-accessible attackers to inject and execute arbitrary JavaScript within an authenticated victim's browser by delivering a crafted URL that manipulates the client-side DOM environment. All three AEM product tracks are affected: Cloud Service through 2026.5.0, the classic 6.5 series through 6.5.24, and 6.5 LTS through SP1. The CVSS scope change (S:C) reflects that execution escapes the vulnerable component into the victim's broader browser session, enabling session token theft or unauthorized AEM actions on the victim's behalf; however, no public exploit code has been identified at time of analysis and SSVC confirms no in-the-wild exploitation.
Technical ContextAI
Adobe Experience Manager (AEM) is an enterprise-grade web content management and digital asset management platform widely deployed by large organizations. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in its DOM-based variant: rather than the malicious payload being injected server-side, the attack occurs entirely client-side when the victim's browser processes attacker-controlled data from the DOM (e.g., URL fragment identifiers, window.location properties) without adequate sanitization or output encoding. This means the malicious payload may never touch the server, bypassing traditional server-side input filtering. Three CPE strings confirm the scope across product lines: cpe:2.3:a:adobe:adobe_experience_manager_as_a_cloud_service, cpe:2.3:a:adobe:adobe_experience_manager_6.5, and cpe:2.3:a:adobe:adobe_experience_manager_6.5_lts. The CVSS S:C (scope changed) metric reflects that injected JavaScript executes in the victim's browser security context, potentially accessing cookies, session tokens, and cross-origin data beyond the AEM component itself.
RemediationAI
Vendor-released patches are available for all affected product tracks per Adobe advisory APSB26-74 (https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html). AEM as a Cloud Service tenants should confirm their environment has been updated to 2026.6.0 or later - Adobe typically applies cloud updates automatically, but administrators should verify the current version in the Cloud Manager console. AEM 6.5 on-premises deployments should apply Service Pack 6.5.25 (Hotfix for NPR-43972). AEM 6.5 LTS deployments should apply SP2 (Hotfix for NPR-43972). As compensating controls prior to patching: restrict AEM authoring environment access to trusted internal networks or VPN only, which prevents external attackers from delivering crafted links to AEM sessions; enforce a strict Content-Security-Policy header to limit inline script execution - note this may interfere with some AEM authoring widgets and should be tested in a staging environment before deployment. Security awareness training to discourage AEM authors from clicking unsolicited external links is a low-cost behavioral control.
Sensitive file disclosure and potential account takeover in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6
Server-Side Request Forgery in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets a low-privileged
Arbitrary file system read in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets remote unauthenti
Missing authentication in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6.5 LTS) lets a remote unauthentica
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persist
Stored Cross-Site Scripting in Adobe Experience Manager enables a low-privileged authenticated attacker to inject persis
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to inject and execute
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to manipulate client-side DO
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malici
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute malicious
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today