EUVD-2026-35640
GHSA-8hvc-rjx3-fpx6
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
AnalysisAI
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) versions up to and including 6.5.24, LTS SP1, and 2026.04 allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating the DOM environment through a crafted webpage. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable AEM component itself - for instance, to other browser-accessible resources or session contexts. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires deliberate social engineering to induce user interaction.
Technical ContextAI
Adobe Experience Manager is an enterprise-grade CMS and digital experience platform used for web content management. DOM-based XSS (CWE-79) is distinct from reflected or stored XSS: the payload is never sent to or processed by the server. Instead, client-side JavaScript in AEM reads attacker-controlled data from the DOM (e.g., URL fragment, document.location, or query parameters) and writes it into the page without sanitization, causing the browser to execute the injected script. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C indicates: remote network delivery, low attack complexity, a low-privilege account is required on the attacker's side, victim interaction is mandatory, and the vulnerability crosses a security boundary (scope change). EUVD-2026-35640 tracks this in the EU vulnerability database. Affected CPE is inferred as Adobe Experience Manager versions 0 through 2026.04 per EUVD data.
RemediationAI
The primary fix is to apply the update documented in Adobe security bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. An exact fixed version number was not present in the provided input data - verify the specific target release against that advisory before patching. As a compensating control while patching, restrict the creation and modification of content or pages by untrusted or lower-privilege AEM author accounts, since the attack requires a low-privileged authenticated attacker to craft or influence a page or URL that a higher-privileged user will visit. Enforcing strict role-based access controls and limiting who can publish or link content reduces exposure. Additionally, deploying a Content Security Policy (CSP) header on AEM-served pages that disallows inline script execution and restricts script sources can significantly mitigate DOM XSS impact; however, configuring CSP on complex CMS environments may break legitimate page functionality and requires testing. User awareness around not clicking untrusted AEM links from colleagues is a low-cost supplementary control.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today