EUVD-2026-44385
GHSA-8cm9-7f4v-jfxf
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Low-privilege account required for injection (PR:L), victim must visit page (UI:R), scope changes to victim's browser session (S:C); no availability impact applies.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
AnalysisAI
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who visits the affected page. All three deployment variants are affected - AEM 6.5 (≤6.5.24), AEM 6.5 LTS (≤SP1), and AEM as a Cloud Service (≤2026.5.0) - with patches released under Adobe advisory APSB26-74. No public exploit code or active exploitation has been identified; EPSS sits at 0.29% (21st percentile) and SSVC confirms exploitation status as none, placing this in a patch-on-schedule rather than emergency-response posture.
Technical ContextAI
Adobe Experience Manager (AEM) is a large-scale enterprise Digital Experience Platform (DXP) and CMS that allows content authors to create and manage web pages through a rich editing interface, including form-based input fields. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input written to persistent storage - the AEM content repository (JCR) - is later rendered in victim browsers without adequate sanitization or encoding. The changed-scope designation (S:C) reflects the classic stored XSS pattern: the injection occurs in one browser session but executes in a different user's browser context, crossing a security boundary. Affected CPEs cover three distinct product lines: cpe:2.3:a:adobe:adobe_experience_manager_6.5, cpe:2.3:a:adobe:adobe_experience_manager_6.5_lts, and cpe:2.3:a:adobe:adobe_experience_manager_as_a_cloud_service, all with wildcard version ranges indicating broad coverage within each line up to the fixed releases.
RemediationAI
Adobe has released targeted patches addressing this vulnerability. For AEM 6.5, upgrade to version 6.5.25 which includes the Hotfix for NPR-43972. For AEM 6.5 LTS, apply SP2, which also incorporates the Hotfix for NPR-43972. For AEM as a Cloud Service, the fix is included in the 2026.6.0 release. Full remediation details and download links are available in Adobe security bulletin APSB26-74 at https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html. Where immediate patching is not possible, organizations should consider restricting content-authoring privileges to fully trusted internal users only, enforcing a strict Content Security Policy (CSP) header to limit script execution to trusted origins - noting this may break AEM's own JavaScript-heavy editing interface and should be tested carefully - and auditing existing content repositories for already-injected payloads.
Sensitive file disclosure and potential account takeover in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6
Server-Side Request Forgery in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets a low-privileged
Arbitrary file system read in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets remote unauthenti
Missing authentication in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6.5 LTS) lets a remote unauthentica
Stored Cross-Site Scripting in Adobe Experience Manager enables a low-privileged authenticated attacker to inject persis
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to inject and execute
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to manipulate client-side DO
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated network-accessible attackers to inject a
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malici
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute malicious
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today