EUVD-2026-35602
GHSA-hqfm-8529-ffc3
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
AnalysisAI
Stored XSS in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, and 2026.04 and earlier allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user - including higher-privileged administrators - browses a page containing the injected field, the script executes in their browser under the AEM origin, with scope change (S:C per CVSS) enabling impact beyond the authoring component itself. No public exploit code or active exploitation has been identified at time of analysis; however, the persistent nature of the injection and AEM's typical enterprise deployment profile (admin, author, and reviewer roles sharing the same domain) elevate practical risk above what the medium CVSS score alone suggests.
Technical ContextAI
Adobe Experience Manager is an enterprise content management system widely used for web authoring, digital asset management, and form creation. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): AEM fails to adequately sanitize attacker-controlled input before storing it in the content repository and subsequently rendering it to other users' browsers. The CVSS scope change flag (S:C) is technically significant - it confirms that the injected script executes under the AEM application's browser origin, crossing the security boundary and potentially accessing cookies, local storage, or DOM state of the victim's authenticated AEM session. Affected versions per ENISA EUVD-2026-35602 span all AEM releases through 2026.04, covering both the legacy 6.5.x service pack branch and the cloud-native LTS and rolling release tracks. No CPE strings were provided in the input data.
RemediationAI
Apply the fix documented in Adobe Security Bulletin APSB26-56, available at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The bulletin covers all three affected AEM release tracks (6.5.x, LTS, and cloud rolling); administrators must consult the advisory directly to identify the exact patched service pack or build number for their deployed branch, as the input data does not specify a precise fixed version. Patch availability is confirmed per vendor advisory (APSB26-56), but exact fix version numbers per branch are not independently verified from the provided data - treat the advisory as authoritative. As a compensating control prior to patching, restrict AEM author permissions so that only the minimum necessary set of trusted users can edit form fields, using AEM's built-in ACL and permission model - this directly limits the pool of principals who can inject payloads, though it may impact legitimate content authoring workflows. Additionally, if the AEM author environment is not required to be publicly internet-facing, network-layer restrictions (firewall rules, VPN gating) can reduce the attacker's ability to reach the authoring interface at all, limiting exploitation to internal or authenticated network paths only.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today