EUVD-2026-44382
GHSA-c3h3-38p4-63wr
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L confirmed by requirement for attacker credentials; UI:R by mandatory victim interaction; S:C because JavaScript executes in victim browser, a distinct security principal from the AEM server; no availability impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
AnalysisAI
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to manipulate client-side DOM sources and execute arbitrary JavaScript within an authenticated victim's browser session. All three supported deployment tracks are affected: AEM as a Cloud Service (≤2026.5.0), AEM 6.5 LTS (≤SP1), and AEM 6.5 on-premises (≤6.5.24). No public exploit has been identified and SSVC classifies exploitation status as none, but patches are available across all affected tracks per Adobe advisory APSB26-74.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) in its DOM-based variant means the vulnerability exists entirely in client-side JavaScript: attacker-controlled data flows from a DOM source (e.g., location.hash, document.referrer, or URL parameters) into a dangerous sink (e.g., innerHTML, eval, or document.write) without proper sanitization, bypassing server-side filtering entirely. Adobe Experience Manager is a Java-based enterprise Content Management System with rich client-side authoring interfaces, making DOM manipulation a plausible attack surface in its editing or preview components. Three CPE strings confirm the scope: cpe:2.3:a:adobe:adobe_experience_manager_as_a_cloud_service, cpe:2.3:a:adobe:adobe_experience_manager_6.5_lts, and cpe:2.3:a:adobe:adobe_experience_manager_6.5. The CVSS S:C (Scope Changed) designation reflects that the injected script executes in the victim's browser context - a distinct security principal from the AEM server - allowing cross-origin data theft or session manipulation.
RemediationAI
The primary fix is to upgrade to a patched release per your deployment track: AEM as a Cloud Service should be updated to 2026.6.0 or later; AEM 6.5 on-premises should be updated to 6.5.25 (Hotfix for NPR-43972); AEM 6.5 LTS should be updated to SP2 (Hotfix for NPR-43972). All patch versions are confirmed by Adobe APSB26-74 (https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html) and corroborated by EUVD-2026-44382. If immediate patching is not feasible, compensating controls include restricting AEM authoring and preview interfaces to trusted internal networks or VPN, reducing the attack surface by limiting low-privilege user accounts that can craft or share internal links, and enforcing a strict Content Security Policy (CSP) header on AEM-served pages to block inline script execution - note that CSP may interfere with AEM's rich authoring UI and should be tested in a staging environment before broad rollout.
Sensitive file disclosure and potential account takeover in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6
Server-Side Request Forgery in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets a low-privileged
Arbitrary file system read in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets remote unauthenti
Missing authentication in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6.5 LTS) lets a remote unauthentica
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persist
Stored Cross-Site Scripting in Adobe Experience Manager enables a low-privileged authenticated attacker to inject persis
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to inject and execute
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated network-accessible attackers to inject a
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malici
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute malicious
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today