EUVD-2026-35633
GHSA-pvvq-gf45-7jq5
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
AnalysisAI
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, and 2026.04 and earlier allows an authenticated attacker with low privileges to execute arbitrary JavaScript in a victim's browser by manipulating the DOM environment through a crafted webpage. The CVSS vector confirms scope change (S:C), meaning the injected script can affect browser contexts beyond the vulnerable AEM page itself - enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No public exploit code or active exploitation has been identified at time of analysis, and exploitation requires user interaction, limiting opportunistic mass exploitation.
Technical ContextAI
Adobe Experience Manager is an enterprise-grade CMS and digital asset management platform widely deployed in large organizations. DOM-based XSS (CWE-79) is distinct from reflected or stored XSS in that the vulnerable code path exists entirely in client-side JavaScript: attacker-controlled data flows from a DOM source (such as location.hash, document.referrer, or URL parameters) into an unsafe DOM sink (innerHTML, eval, document.write, etc.) without server-side involvement. This means WAFs and server-side input validation are typically ineffective as defenses, since the malicious payload never reaches the server. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C is consistent with a client-side injection reaching across iframe or origin boundaries, explaining the scope change. EUVD-2026-35633 corroborates the affected version range as all AEM releases up to and including 2026.04.
RemediationAI
The primary remediation is to apply the patch referenced in Adobe Security Bulletin APSB26-56, available at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The exact patched version number was not independently confirmed from the provided data - consult the advisory directly to identify the specific target version for your AEM release train (6.5 LTS or cloud 2026.x). If immediate patching is not feasible, the following compensating controls are relevant: restrict AEM author environments to trusted internal networks or VPN to reduce the attacker's ability to send crafted links to internal users; enforce strict Content-Security-Policy (CSP) headers on AEM responses to limit which script sources are trusted, noting that AEM's extensibility may require allowlisting some origins and testing is essential before deploying CSP broadly; and train users to be suspicious of AEM-origin URLs received via external channels. Because this is DOM-based XSS, server-side WAF rules provide limited protection and should not be relied upon as a sole control.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today