EUVD-2026-44378
GHSA-v4xj-v2gq-xf92
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Low-privilege AEM account required to construct the payload (PR:L), victim interaction is mandatory for DOM execution (UI:R), and scope changes as injected script executes in the victim's browser context beyond the AEM application boundary (S:C).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
AnalysisAI
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript within a victim's browser by delivering a crafted URL that manipulates the client-side DOM environment. Affected deployments span AEM 6.5 (≤6.5.24), AEM 6.5 LTS (≤SP1), and AEM as a Cloud Service (≤2026.5.0) - three distinct product lines with broad enterprise reach. No active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.27% at the 19th percentile alongside an SSVC exploitation status of 'none' indicate low near-term threat activity, though patching remains warranted given the changed-scope impact.
Technical ContextAI
Adobe Experience Manager (AEM) is a Java-based enterprise content management platform used for web publishing, digital asset management, and marketing workflows. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) in its DOM-based form, meaning attacker-controlled data flows from a DOM source - such as a URL fragment or query parameter - into a dangerous sink within AEM's client-side JavaScript without adequate sanitization. Crucially, DOM-based XSS is processed entirely in the victim's browser; the server never sees the injected payload, which limits the effectiveness of server-side WAF rules and makes detection harder. The CVSS scope-change metric (S:C) reflects that the injected script executes in a browser context that crosses the AEM application boundary. Three CPE-confirmed product lines are affected: cpe:2.3:a:adobe:adobe_experience_manager_6.5, cpe:2.3:a:adobe:adobe_experience_manager_6.5_lts, and cpe:2.3:a:adobe:adobe_experience_manager_as_a_cloud_service.
RemediationAI
The primary remediation is to apply Adobe's vendor-released patches per Security Bulletin APSB26-74 (https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html). For AEM 6.5 on-premises deployments, upgrade to 6.5.25 or apply the specific Hotfix for NPR-43972. For AEM 6.5 LTS, apply SP2 (Hotfix for NPR-43972). AEM as a Cloud Service tenants on ≤2026.5.0 should confirm their environment has been updated to 2026.6.0, as Adobe typically applies cloud releases automatically - administrators should verify the active release version in the Cloud Manager console. Where immediate patching is not feasible, restrict access to AEM Author environments to trusted internal networks or VPN-only access; this does not eliminate the vulnerability but removes internet-facing exposure and dramatically narrows the population of victims reachable via crafted phishing URLs. Additionally, enforcing HttpOnly and Secure flags on AEM session cookies limits the attacker's ability to exfiltrate session tokens via the injected script, though it does not prevent DOM manipulation or form-submission attacks.
Sensitive file disclosure and potential account takeover in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6
Server-Side Request Forgery in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets a low-privileged
Arbitrary file system read in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets remote unauthenti
Missing authentication in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6.5 LTS) lets a remote unauthentica
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persist
Stored Cross-Site Scripting in Adobe Experience Manager enables a low-privileged authenticated attacker to inject persis
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to inject and execute
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to manipulate client-side DO
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated network-accessible attackers to inject a
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malici
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute malicious
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today