EUVD-2026-35607
GHSA-8jff-x769-wx6g
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
AnalysisAI
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in other users' browsers upon page load. Affected versions span the 6.5.x branch through 6.5.24, the LTS SP1 track, and cloud-native releases through 2026.04. No public exploit code or active exploitation has been identified at time of analysis; however, the changed scope (S:C) elevates real-world impact by enabling session hijacking or credential theft against higher-privileged users such as authors or administrators.
Technical ContextAI
Adobe Experience Manager (AEM) is an enterprise content management and digital experience platform built on Apache Sling and OSGi. The vulnerability maps to CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), meaning user-supplied input is persisted server-side without adequate sanitization or output encoding and later rendered in the browser as executable script. The CVSS vector AV:N/AC:L/PR:L indicates the injection point is reachable over the network with low complexity, requiring only a low-privileged account (e.g., a contributor or author role). The S:C (Scope Changed) attribute signals that the exploit crosses a security boundary - from the attacker's session context into other users' browser contexts - which is characteristic of stored XSS where the injected payload executes under the victim's session. EUVD-2026-35607 corroborates affected product scope as all AEM releases up to and including 2026.04.
RemediationAI
Apply the patch detailed in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. An exact patched version number is not independently confirmed from the available data beyond 'versions after 2026.04' - consult the advisory directly to identify the correct update package for your track (6.5.x, LTS, or cloud). As a compensating control while patching is pending, restrict write access to AEM form fields and rich-text components to the minimum necessary accounts, reducing the attacker's ability to inject payloads. Additionally, enforcing a strict Content Security Policy (CSP) header that disallows inline script execution can mitigate impact if a payload is injected - note that AEM's built-in RTE components may require CSP tuning to avoid breaking legitimate functionality. Audit existing content for suspicious script tags if low-privileged contributor accounts are broadly provisioned.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today