What is the CVSS score of EUVD-2026-35604?

EUVD-2026-35604 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager EUVD-2026-35604

| CVE-2026-34692 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-gww6-v486-6v7r

XSS Adobe

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:00 vuln.today

DescriptionNVD

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

AnalysisAI

DOM-based Cross-Site Scripting in Adobe Experience Manager versions 6.5.24, LTS SP1, and 2026.04 and earlier allows an authenticated attacker to inject malicious JavaScript that executes entirely within the victim's browser by manipulating client-side DOM sinks. The CVSS scope change (S:C) signal indicates successful exploitation can affect browser components beyond the AEM instance itself - enabling session hijacking or unauthorized actions on behalf of the victim. Adobe PSIRT has issued Security Bulletin APSB26-56 covering this issue; no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Adobe Experience Manager (AEM) is an enterprise-grade content management system used for web content delivery and digital asset management across both on-premise (6.5.x) and cloud-managed (202x.xx) deployments. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the DOM-based variant, which is distinct from reflected or stored XSS in that the malicious payload is processed entirely client-side without server reflection. In DOM-based XSS, attacker-controlled data from a DOM source - such as a URL fragment, query parameter, or location hash - is read by client-side JavaScript and written to a dangerous sink (e.g., innerHTML, document.write, eval) without sanitization. No CPE strings were provided in the source data, but affected product lines are confirmed as AEM 6.5.x on-premise and AEM as a Cloud Service (2026.x and prior). The CVSS vector AV:N/AC:L/PR:L indicates the vulnerability is remotely reachable with low attack complexity and requires only a low-privileged account on the platform.

RemediationAI

The primary remediation is to apply the patch documented in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The exact patched version numbers for each AEM release line (6.5.x, LTS, and 2026.x Cloud Service) are not independently confirmed in the available source data and must be obtained directly from that bulletin. As compensating controls prior to patching, organizations should enforce a strict Content-Security-Policy (CSP) header that restricts script execution to known-safe origins - note this may require testing as overly restrictive CSP can break AEM's own JavaScript-dependent authoring interfaces. Additionally, restricting AEM author and publish tier access to trusted IP ranges or VPN reduces the attack surface given that social engineering delivery is required (UI:R). User education targeting AEM authors and administrators about phishing-delivered AEM URLs is a low-cost secondary control given the mandatory user interaction requirement.