EUVD-2026-44376
GHSA-h64q-x86c-crf5
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attacker requires a low-privileged AEM account and victim interaction; DOM XSS changes scope to victim browser context; no availability impact applies.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
AnalysisAI
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute malicious JavaScript in a victim's authenticated browser session, affecting AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP1, and AEM as a Cloud Service through 2026.5.0. The changed-scope designation (S:C) in the CVSS 3.1 vector indicates that a successful exploit can affect resources beyond the originating AEM page context, enabling session hijacking or unauthorized content manipulation. No public exploit code or CISA KEV listing exists at time of analysis; EPSS is 0.27% (19th percentile), consistent with the SSVC assessment of no active exploitation and a non-automatable attack path.
Technical ContextAI
Adobe Experience Manager (AEM) is an enterprise-grade content management platform widely deployed by large organizations for web, mobile, and digital experience delivery. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the DOM-based XSS variant - the most client-side of the XSS classes. In DOM-based XSS, vulnerable client-side JavaScript reads attacker-controlled data from the DOM (such as URL hash fragments or query parameters) and writes it back into the page without proper sanitization, meaning the malicious payload never transits the server and thus evades server-side filtering controls. Affected CPEs span three product lines: cpe:2.3:a:adobe:adobe_experience_manager_6.5, cpe:2.3:a:adobe:adobe_experience_manager_6.5_lts, and cpe:2.3:a:adobe:adobe_experience_manager_as_a_cloud_service, covering both on-premises long-term support releases and the SaaS cloud offering.
RemediationAI
The primary fix is to apply vendor-released patches documented in Adobe Security Bulletin APSB26-74 (https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html): AEM 6.5 deployments should upgrade to patch 6.5.25 (Hotfix NPR-43972); AEM 6.5 LTS deployments should apply SP2 including Hotfix NPR-43972; AEM as a Cloud Service environments should confirm they have been updated to the 2026.6.0 release, which Adobe typically applies automatically to cloud tenants. Where immediate patching is not feasible, deploying a strict Content Security Policy (CSP) - specifically restricting script-src to known safe origins - can materially reduce the exploitability of DOM-based XSS, though this may require regression testing given AEM's JavaScript-heavy interface. Additionally, restricting which authenticated users can generate or share AEM URLs (e.g., limiting author-tier access to vetted personnel) reduces the attacker's ability to reach a privileged victim via phishing.
Sensitive file disclosure and potential account takeover in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6
Server-Side Request Forgery in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets a low-privileged
Arbitrary file system read in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets remote unauthenti
Missing authentication in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6.5 LTS) lets a remote unauthentica
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persist
Stored Cross-Site Scripting in Adobe Experience Manager enables a low-privileged authenticated attacker to inject persis
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to inject and execute
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to manipulate client-side DO
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated network-accessible attackers to inject a
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malici
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today