EUVD-2026-44384
GHSA-52vf-xjg9-pg5p
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network delivery and low complexity match DOM-XSS via crafted URL; PR:L reflects required authenticated attacker; UI:R and S:C reflect mandatory victim interaction and browser-context escape; no availability impact applies.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
AnalysisAI
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to inject and execute malicious JavaScript within a victim's browser by manipulating DOM-writable sinks in the AEM interface. Affected deployments span AEM as a Cloud Service (≤2026.5.0), AEM 6.5 LTS (≤SP1), and AEM 6.5 (≤6.5.24). No active exploitation has been identified - EPSS sits at 0.27% (19th percentile), CISA SSVC assigns exploitation status of 'none' and automatable 'no', and the vulnerability is absent from the CISA KEV catalog, collectively indicating low current threat momentum despite the scope-change component.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) manifests here as a DOM-based XSS variant, distinct from reflected or stored XSS in that the malicious payload flows entirely through browser-side DOM APIs - document.location, document.write, innerHTML, eval - without requiring a server-side echo. Server-side output filtering is therefore insufficient to block exploitation. Adobe Experience Manager is an enterprise-grade Java/OSGi content management platform built on Apache Sling and Felix, commonly used for large-scale digital experience delivery. The three affected CPE lines - cpe:2.3:a:adobe:adobe_experience_manager_as_a_cloud_service, cpe:2.3:a:adobe:adobe_experience_manager_6.5_lts, and cpe:2.3:a:adobe:adobe_experience_manager_6.5 - cover both the managed cloud offering and on-premises long-term-support branches, broadening the exposure surface across cloud and self-hosted deployment models.
RemediationAI
Vendor-released patches are available for all three product lines. AEM as a Cloud Service users should update to version 2026.6.0 or later. AEM 6.5 LTS users should apply Service Pack 2 with the hotfix for NPR-43972. AEM 6.5 users should upgrade to version 6.5.25 with the hotfix for NPR-43972. Full patching instructions are documented in Adobe APSB26-74 at https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html. For environments where immediate patching is not feasible, apply a strict Content Security Policy (CSP) header that prohibits inline script execution and restricts script sources to trusted origins - note that AEM authoring interfaces may rely on inline scripts and CSP tuning will require testing to avoid breaking authoring workflows. Additionally, restrict authenticated AEM access to known trusted users by enforcing network-level controls on AEM author tier endpoints and audit low-privileged account provisioning to limit the attacker's initial foothold surface.
Sensitive file disclosure and potential account takeover in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6
Server-Side Request Forgery in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets a low-privileged
Arbitrary file system read in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets remote unauthenti
Missing authentication in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6.5 LTS) lets a remote unauthentica
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persist
Stored Cross-Site Scripting in Adobe Experience Manager enables a low-privileged authenticated attacker to inject persis
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to manipulate client-side DO
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated network-accessible attackers to inject a
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malici
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute malicious
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today