EUVD-2026-35605
GHSA-h3jc-v8xg-f37x
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
AnalysisAI
DOM-based Cross-Site Scripting in Adobe Experience Manager (versions 6.5.24, LTS SP1, and 2026.04 and earlier) allows a low-privileged authenticated attacker to inject and execute malicious JavaScript in a victim's browser by manipulating client-side DOM sinks. The CVSS scope-changed flag (S:C) indicates the injected script can operate beyond the vulnerable component's security context, enabling session theft, credential harvesting, or unauthorized administrative actions against higher-privileged users within the same AEM instance. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the cross-privilege escalation potential in shared AEM deployments warrants prompt patching.
Technical ContextAI
Adobe Experience Manager (AEM) is a Java-based enterprise content management and digital experience platform widely deployed in large organizations for web publishing, digital asset management, and marketing workflows. DOM-based XSS (CWE-79: Improper Neutralization of Input During Web Page Generation) occurs when client-side JavaScript reads attacker-controlled data from an untrusted DOM source - such as the URL fragment, document.referrer, or window.name - and writes it to the page via an unsafe sink (e.g., innerHTML, document.write) without sanitization. Unlike reflected or stored XSS, the malicious payload never reaches the server, rendering server-side output encoding ineffective as a sole mitigation. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C confirms the flaw is network-reachable with low complexity, requires a low-privilege AEM account, demands victim interaction, and crosses security boundaries - consistent with a client-side flaw in AEM's authoring or preview interface that can be triggered against any co-resident user.
RemediationAI
Apply the patch documented in Adobe Security Bulletin APSB26-56, available at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The exact remediated version number was not included in the provided input data and must be confirmed directly from APSB26-56 before deployment - do not infer a fix version from this analysis. Organizations running AEM as a Cloud Service should verify whether Adobe's automated patching pipeline has already applied the fix for the 2026.x release line. As interim compensating controls: (1) Restrict AEM authoring-environment access to the minimum set of fully vetted, trusted users, since PR:L authentication is a prerequisite - reducing the authenticated user population directly shrinks the attack surface, with the trade-off of limiting self-service content workflows; (2) Deploy or harden Content Security Policy (CSP) headers on AEM-served pages to restrict inline script execution and limit DOM-based XSS impact, noting that CSP changes require regression testing against AEM's JavaScript-heavy authoring UI to avoid breaking legitimate functionality; (3) For AEM 6.5.x on-premises, ensure Service Pack patching pipelines are current and monitor the AEM Security Checklist for additional hardening guidance.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today