EUVD-2026-35709
GHSA-2f49-w32g-jq92
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
AnalysisAI
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) versions up to and including 6.5.24, LTS SP1, and 2026.04 enables a low-privileged authenticated attacker to persist malicious JavaScript into vulnerable form fields. The injected script executes in the browser of any victim who subsequently visits the affected page, with a changed scope designation (S:C) indicating the impact crosses security boundaries beyond the directly vulnerable component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of low privilege requirements and changed scope makes this a meaningful risk in multi-tenant or large-organization AEM deployments where content authoring access is broadly distributed.
Technical ContextAI
Adobe Experience Manager is an enterprise content management platform (CMS/DAM) widely used for web publishing and digital asset management. CWE-79 (Improper Neutralization of Input During Web Page Generation) in its stored variant means attacker-supplied input is persisted to a backend data store and later rendered in the browser of other users without adequate sanitization or encoding. The CVSS vector S:C (Scope Changed) is significant: in stored XSS, this reflects that the browser's same-origin policy boundary for a different component or session context is breached - the attacker's injected code executes with the trust level of the victim's authenticated session, not the attacker's own session. The AV:N/AC:L combination confirms the injection can be delivered over the network with no special conditions, and PR:L confirms that a standard low-privileged account (e.g., content author role) is sufficient to plant the payload. The ENISA EUVD entry EUVD-2026-35709 corroborates the NVD data, with affected range listed as AEM versions 0 through 2026.04 inclusive.
RemediationAI
Consult and apply the fix detailed in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The exact patched release version is not independently confirmed from the available input data - the advisory should be referenced directly to identify the specific upgrade target for your AEM track (6.5.x, LTS, or Cloud Service). As an interim compensating control where immediate patching is not feasible, restrict content authoring and form-field editing permissions to the minimum set of trusted users, removing access from contractors, partners, or external contributors. AEM's built-in Content Security Policy (CSP) configuration can be hardened to limit script execution sources, reducing XSS impact - note this may break legitimate inline scripts and requires regression testing. Regularly audit user roles and remove low-privileged accounts that do not require content submission capabilities. These controls reduce the attacker's ability to plant payloads but do not eliminate the underlying vulnerability and should not substitute for patching.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today