Apache Sling XSS CVE-2026-91928

Exploitation requires an application built on the Apache Sling XSS Protection API (versions before 2.4.12) that uses the library to sanitize or encode attacker-influenced input reflected into an HTML response - most commonly Apache Sling or Adobe AEM sites. A victim must load the affected page/interact with the malicious link (user interaction), and the payload must reach a rendering path that relies on the vulnerable library rather than a separate encoder. Limiting factors: impact is confined to the victim's browser session, requires user interaction, and depends on the deployed application actually routing untrusted data through the flawed API; the generic advisory does not confirm whether the vector is reflected, stored, or DOM-based.

No CVSS score or vector was supplied by NVD or Apache, so severity must be inferred. This is a genuine CWE-79 cross-site scripting flaw in the Apache Sling XSS Protection API library - notable because the library IS the XSS-defense mechanism, so a flaw here silently weakens every downstream consumer (Apache Sling and Adobe AEM applications that rely on it for output encoding). Classic reflected/stored XSS of this type typically scores around CVSS 6.1 (MEDIUM). No EPSS probability, no CISA KEV listing, and no public exploit code are present in the provided data - no public exploit identified at time of analysis. There is no conflicting-signal problem because only the Apache advisory exists; the main gap is that the description is fully generic (it names no bypass vector, injection sink, or affected API method, unlike sibling CVEs CVE-2026-73192/CVE-2026-91852), so exploit specifics cannot be verified. Real-world priority is moderate-and-conditional: the impact ceiling of a single XSS is browser-session-scoped (C:L/I:L), but the multiplier effect of a flaw in a shared sanitization library means AEM/Sling operators should patch to 2.4.12 promptly even absent evidence of exploitation.

An attacker crafts input containing script markup that the Apache Sling XSS filter fails to neutralize, then delivers it via a URL or form to an application relying on the library for output encoding. When a victim's browser renders the page, the attacker's JavaScript executes in the victim's session context, enabling session-token theft or actions on the victim's behalf. No public proof-of-concept is available for this specific CVE.