EUVD-2026-80895
GHSA-rwqw-vmpp-qf38
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Authenticated low-priv author injects (PR:L), victim must render the page (UI:R), stored XSS crosses into victim browser context (S:C) with limited C/I and no availability impact.
Primary rating from Vendor (adobe).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
AnalysisAI
Stored cross-site scripting in Adobe Experience Manager lets a low-privileged authenticated attacker (CVSS vector PR:L) persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who later views the affected page (UI:R), driving the score to 5.4 with a changed scope (S:C) because the impact lands on the victim's session rather than the vulnerable component itself. The affected line-up is AEM as a Cloud Service, AEM 6.5 LTS, and AEM 6.5, and exploitation is not self-contained: the attacker needs an account able to write into the form field and must wait for a separate, ideally higher-privileged, victim to browse that page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) an authenticated low-privileged account with access to write into a vulnerable form field in Adobe Experience Manager (PR:L - not anonymous), and (2) a victim user subsequently browsing the page that renders the injected field (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely moderate, not high-priority, issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact fixed version is provided in the available data, so the primary action is to follow Adobe Security Bulletin apsb26-98 (https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html) and apply the vendor-designated update or hotfix for your AEM as a Cloud Service, AEM 6.5 LTS, or AEM 6.5 deployment; cloud service instances are updated by Adobe on the service schedule, while 6.5 customers must install the corresponding service pack or hotfix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Sensitive file disclosure and potential account takeover in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6
Server-Side Request Forgery in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets a low-privileged
Arbitrary file system read in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets remote unauthenti
Missing authentication in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6.5 LTS) lets a remote unauthentica
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persist
Stored Cross-Site Scripting in Adobe Experience Manager enables a low-privileged authenticated attacker to inject persis
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to inject and execute
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to manipulate client-side DO
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated network-accessible attackers to inject a
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malici
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today