EUVD-2026-35603
GHSA-w2cf-7h33-5x68
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
AnalysisAI
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated, low-privileged attacker to execute arbitrary JavaScript in a victim's browser by enticing them to visit a crafted webpage. Affected versions span the 6.5.x line through 6.5.24, the LTS SP1 branch, and all cloud releases through 2026.04. The Scope:Changed CVSS attribute indicates the injected script can affect resources beyond the originating AEM context - elevating the practical impact above what the 5.4 Medium score alone suggests. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Technical ContextAI
Adobe Experience Manager (AEM) is an enterprise content management platform used for web, digital asset, and forms management. DOM-based XSS (CWE-79) differs from reflected or stored XSS in that the malicious payload never reaches the server - instead, client-side JavaScript reads attacker-controlled data from the DOM (e.g., URL fragment, document.location, or postMessage data) and writes it into the page without sanitization. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C confirms a network-reachable, low-complexity attack that crosses trust boundaries (Scope Changed), consistent with a DOM sink writing into a context that can influence sibling frames or downstream JavaScript execution. The CWE-79 root cause is failure to neutralize user-controllable input before inserting it into a dynamic execution context in the browser.
RemediationAI
Consult Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html for the official patch. An exact fixed version number was not independently confirmed from the data available at time of analysis - the advisory should be treated as the authoritative source for target upgrade versions across the 6.5.x, LTS SP1, and 2026.x cloud release tracks. As a compensating control while patching, restrict the ability of lower-privileged AEM roles (authors, contributors) to share or publish URLs containing fragment identifiers or query parameters that feed into DOM sinks, and enforce Content-Security-Policy headers on AEM author and publish environments to block inline script execution - note that CSP requires careful configuration to avoid breaking AEM's own JavaScript-heavy UI. User awareness training to distrust unsolicited AEM links is a low-cost interim measure.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today