EUVD-2026-35613
GHSA-957g-c2rc-xhwr
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
AnalysisAI
Stored Cross-Site Scripting in Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user browses to a page containing the poisoned field, the script executes in their browser context. The CVSS scope change (S:C) signals that exploitation crosses a security boundary - a content-authoring account can target higher-privileged administrative sessions - amplifying the effective impact beyond the medium CVSS score of 5.4. No public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
Adobe Experience Manager (AEM) is an enterprise web content management and digital experience platform. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class: user-supplied input stored server-side is later rendered without adequate output encoding, causing the browser to interpret attacker-controlled data as executable script. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C confirms the attack surface is network-accessible, requires low complexity, a low-privileged account for injection, and user interaction for triggering - a classic stored XSS profile. The scope change (S:C) is technically significant: it indicates the injected script executes in a browsing context different from the vulnerable component itself, enabling cross-context attacks such as session hijacking against administrators. EUVD-2026-35613 corroborates affected version bounds as all releases up to and including 2026.04.
RemediationAI
The primary remediation is to apply the patch documented in Adobe Security Bulletin APSB26-56, available at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. An exact fixed release version was not independently confirmed in the available data - consult the bulletin directly to identify the target Service Pack or Cloud Release. While awaiting patching, restrict the author and contributor roles to only trusted internal users, reducing the pool of accounts that could inject payloads. Content Security Policy (CSP) headers can limit the damage of successful XSS injection by restricting script execution origins, but this is a defense-in-depth measure and does not remediate the underlying vulnerability. Reviewing and auditing recently submitted form content for unexpected script tags is advisable as a detection step. No workarounds that fully eliminate the vulnerability without patching have been identified in the available data.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today