EUVD-2026-44383
GHSA-c37v-mp92-gq8v
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Stored XSS requires network-reachable AEM, low-privilege auth (PR:L), and victim page load (UI:R); scope change (S:C) reflects script executing in victim browser context.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
AnalysisAI
Stored Cross-Site Scripting in Adobe Experience Manager enables a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of any users who view the affected content - including administrators. Affected deployments span AEM as a Cloud Service through 2026.5.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP1. No public exploit identified at time of analysis; EPSS stands at 0.29% (21st percentile) and SSVC confirms no active exploitation, placing this in the medium-priority tier despite the scope-changed CVSS scoring.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) describes a failure to sanitize user-supplied content before it is persisted to the data store and later rendered into page output. Adobe Experience Manager is a Java-based enterprise content management system widely used for authoring and publishing web content at scale. The vulnerability exists in form field handling within AEM's content authoring layer, where submitted input is stored and later reflected into page HTML without adequate output encoding. Because the payload persists server-side, every user who loads the affected page triggers execution - unlike reflected XSS, which requires per-victim delivery. The CVSS scope change (S:C) confirms the injected script crosses security boundaries, executing in the victim's browser security context rather than the attacker's. Affected CPEs: cpe:2.3:a:adobe:adobe_experience_manager_as_a_cloud_service, cpe:2.3:a:adobe:adobe_experience_manager_6.5_lts, and cpe:2.3:a:adobe:adobe_experience_manager_6.5.
RemediationAI
Vendor-released patches are available for all three affected product lines. AEM 6.5 users should upgrade to version 6.5.25 (Hotfix for NPR-43972). AEM 6.5 LTS users should apply SP2 (Hotfix for NPR-43972). AEM as a Cloud Service customers should confirm their environment is on release 2026.6.0 or later, as Adobe manages cloud delivery. Full patching instructions are provided in Adobe Security Bulletin APSB26-74 at https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html. If immediate patching is not feasible, organizations should restrict AEM authoring environment access to the minimum set of trusted users and enforce network-level access controls (such as VPN or IP allowlisting) to reduce the pool of accounts capable of injecting content - noting this does not eliminate risk from already-compromised or malicious insider accounts.
Sensitive file disclosure and potential account takeover in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6
Server-Side Request Forgery in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets a low-privileged
Arbitrary file system read in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets remote unauthenti
Missing authentication in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6.5 LTS) lets a remote unauthentica
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persist
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to inject and execute
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to manipulate client-side DO
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated network-accessible attackers to inject a
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malici
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute malicious
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today