EUVD-2026-44380
GHSA-3v8c-qhxf-wq84
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L confirmed by credential requirement; UI:R by mandatory victim interaction; S:C by browser-context scope change inherent to DOM XSS; no availability impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
AnalysisAI
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary JavaScript within a victim's browser by delivering a crafted URL that manipulates client-side DOM sources, contingent on the victim clicking the link. All three AEM product lines are affected - AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP1, and AEM as a Cloud Service through the 2026.5.0 release - with vendor-confirmed patches now available per advisory APSB26-74. No public exploit code has been identified and EPSS sits at 0.27% (19th percentile), consistent with SSVC's assessment of no current exploitation and non-automatable attack delivery.
Technical ContextAI
Adobe Experience Manager is an enterprise-grade content management and digital experience platform widely used for web authoring, digital asset management, and marketing automation. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically its DOM-based variant, in which attacker-controlled data flows from a DOM source (such as a URL fragment, query parameter, or document.referrer) into a JavaScript sink without adequate sanitization - the malicious payload never traverses the server and thus bypasses server-side output encoding. CPE data confirms three distinct product lines are affected: cpe:2.3:a:adobe:adobe_experience_manager_as_a_cloud_service, cpe:2.3:a:adobe:adobe_experience_manager_6.5_lts, and cpe:2.3:a:adobe:adobe_experience_manager_6.5. The CVSS scope-change flag (S:C) is appropriate because the vulnerable component (the AEM application) differs from the impacted component (the victim's browser session and security context), a defining characteristic of reflected and DOM-based XSS.
RemediationAI
Adobe has released patches for all affected product lines, detailed in advisory APSB26-74 at https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html. For AEM 6.5, upgrade to version 6.5.25 (which incorporates Hotfix for NPR-43972). For AEM 6.5 LTS, apply Service Pack 2 (Hotfix for NPR-43972), which resolves versions through SP1. AEM as a Cloud Service customers on releases through 2026.5.0 should confirm their environment has been updated to the 2026.6.0 release. Where immediate patching of on-premise instances is not feasible, prioritize restricting the AEM Author environment to internal networks or VPN to reduce the attacker's ability to leverage even low-privileged credentials from external networks. Implementing or tightening a Content Security Policy (CSP) header with a strict script-src directive can limit DOM-sink exploitation, but AEM's own JavaScript may require policy exceptions - test thoroughly before enforcing in block mode to avoid breaking authoring functionality. Auditing and pruning unnecessary low-privilege user accounts reduces the credential surface the PR:L prerequisite depends on.
Sensitive file disclosure and potential account takeover in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6
Server-Side Request Forgery in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets a low-privileged
Arbitrary file system read in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets remote unauthenti
Missing authentication in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6.5 LTS) lets a remote unauthentica
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persist
Stored Cross-Site Scripting in Adobe Experience Manager enables a low-privileged authenticated attacker to inject persis
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to inject and execute
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to manipulate client-side DO
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated network-accessible attackers to inject a
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malici
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute malicious
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today