EUVD-2026-44377
GHSA-r7p2-8hwq-4rjv
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Vendor-provided vector is independently validated: PR:L reflects mandatory authenticated attacker access, UI:R the required victim interaction, S:C the cross-context browser impact from DOM XSS, and C:L/I:L/A:N the limited read/write impact with no availability consequence.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
AnalysisAI
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within an authenticated victim's browser session by manipulating client-side DOM data flows. Three product lines are confirmed affected: AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP1), and AEM as a Cloud Service (through 2026.5.0), with patched releases available per Adobe APSB26-74. No public exploit has been identified at time of analysis; EPSS at 0.27% (19th percentile) and SSVC 'Exploitation: none' collectively indicate low current exploitation pressure, though the confirmed scope change (S:C) elevates potential browser-level impact beyond the AEM application boundary.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) in its DOM-based form means the vulnerability exists entirely in client-side JavaScript - the server never processes or reflects the malicious payload through HTTP responses. Instead, attacker-controlled data flows directly into a dangerous DOM sink (such as innerHTML, document.write, or eval) without proper sanitization or output encoding in the browser's execution environment. Adobe Experience Manager is a Java-based enterprise content management and digital experience platform; its authoring and publishing UIs are heavily JavaScript-driven, creating broad DOM manipulation surfaces. Three CPE-confirmed product lines are affected: cpe:2.3:a:adobe:adobe_experience_manager_6.5, cpe:2.3:a:adobe:adobe_experience_manager_6.5_lts, and cpe:2.3:a:adobe:adobe_experience_manager_as_a_cloud_service, indicating the flaw spans both on-premises LTS releases and Adobe's managed cloud offering.
RemediationAI
The primary remediation is to apply vendor-released patches as documented in Adobe security bulletin APSB26-74 (https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html). For AEM 6.5 on-premises, upgrade to version 6.5.25 (hotfix NPR-43972); for AEM 6.5 LTS, apply SP2 (hotfix NPR-43972); for AEM as a Cloud Service tenants, confirm that the environment has been updated to the 2026.6.0 release or later through Adobe's cloud update pipeline. Where immediate patching is not feasible, consider enforcing a strict Content-Security-Policy (CSP) header on AEM-served pages to restrict JavaScript execution to explicitly trusted origins - note this may disrupt legitimate AEM authoring UI components and requires testing in non-production environments first. Additionally, restricting AEM author environment access to trusted internal network segments reduces the attacker's ability to leverage the required low-privilege authenticated access (PR:L). Web application firewall rules targeting known XSS patterns on AEM endpoints can provide shallow additional coverage but should not substitute for patching.
Sensitive file disclosure and potential account takeover in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6
Server-Side Request Forgery in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets a low-privileged
Arbitrary file system read in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets remote unauthenti
Missing authentication in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6.5 LTS) lets a remote unauthentica
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persist
Stored Cross-Site Scripting in Adobe Experience Manager enables a low-privileged authenticated attacker to inject persis
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to inject and execute
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to manipulate client-side DO
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated network-accessible attackers to inject a
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute malicious
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today