EUVD-2026-35616
GHSA-hgpr-5r7c-462c
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
AnalysisAI
DOM-based Cross-Site Scripting in Adobe Experience Manager (versions up to and including 6.5.24, LTS SP1, and 2026.04) enables an authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the DOM environment with attacker-controlled input. The CVSS Scope:Changed designation indicates the injected script can affect resources beyond the AEM application boundary - including session tokens and cross-origin interactions - elevating the practical impact beyond a simple content injection. No public exploit identified at time of analysis and no CISA KEV listing; Adobe has released advisory APSB26-56 addressing this issue.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) manifests here specifically as a DOM-based XSS variant, meaning the vulnerability resides in client-side JavaScript within AEM that reads attacker-controlled data sources - such as URL fragment identifiers, query parameters, or localStorage values - and writes them to the DOM without adequate sanitization or encoding. Unlike reflected or stored XSS, the malicious payload never reaches the server, making server-side input filtering ineffective as a sole control. Adobe Experience Manager is a large-scale enterprise CMS and digital experience platform widely deployed for web publishing and marketing operations; its authoring and preview interfaces are common targets for credential-bearing session hijacking. The CVSS vector AV:N/AC:L confirms the attack is network-reachable at low complexity, and S:C (Scope Changed) confirms the injected script escapes the vulnerable component's security context, enabling interaction with other browser origins or sensitive DOM state.
RemediationAI
Adobe has published security advisory APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html, which contains patching instructions for all affected release branches; organizations should apply the updates detailed therein immediately. The exact patched version numbers are not independently confirmed beyond what Adobe specifies in APSB26-56 - consult the advisory directly rather than relying on third-party version claims. As compensating controls while patching is scheduled: restrict access to AEM authoring and preview environments to trusted IP ranges or VPN to reduce the attacker's ability to deliver crafted URLs to authenticated users; deploy a Content Security Policy (CSP) header on AEM responses that restricts script execution to known-safe origins, reducing the impact of any DOM XSS execution - note that AEM's rich authoring UI may require careful CSP tuning to avoid breaking legitimate functionality; and enforce multi-factor authentication on AEM accounts to raise the bar for obtaining the low-privilege credentials the CVSS PR:L prerequisite requires.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today