What is the CVSS score of EUVD-2026-35616?

EUVD-2026-35616 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager EUVD-2026-35616

| CVE-2026-48258 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-hgpr-5r7c-462c

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:12 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

AnalysisAI

DOM-based Cross-Site Scripting in Adobe Experience Manager (versions up to and including 6.5.24, LTS SP1, and 2026.04) enables an authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the DOM environment with attacker-controlled input. The CVSS Scope:Changed designation indicates the injected script can affect resources beyond the AEM application boundary - including session tokens and cross-origin interactions - elevating the practical impact beyond a simple content injection. No public exploit identified at time of analysis and no CISA KEV listing; Adobe has released advisory APSB26-56 addressing this issue.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) manifests here specifically as a DOM-based XSS variant, meaning the vulnerability resides in client-side JavaScript within AEM that reads attacker-controlled data sources - such as URL fragment identifiers, query parameters, or localStorage values - and writes them to the DOM without adequate sanitization or encoding. Unlike reflected or stored XSS, the malicious payload never reaches the server, making server-side input filtering ineffective as a sole control. Adobe Experience Manager is a large-scale enterprise CMS and digital experience platform widely deployed for web publishing and marketing operations; its authoring and preview interfaces are common targets for credential-bearing session hijacking. The CVSS vector AV:N/AC:L confirms the attack is network-reachable at low complexity, and S:C (Scope Changed) confirms the injected script escapes the vulnerable component's security context, enabling interaction with other browser origins or sensitive DOM state.

RemediationAI

Adobe has published security advisory APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html, which contains patching instructions for all affected release branches; organizations should apply the updates detailed therein immediately. The exact patched version numbers are not independently confirmed beyond what Adobe specifies in APSB26-56 - consult the advisory directly rather than relying on third-party version claims. As compensating controls while patching is scheduled: restrict access to AEM authoring and preview environments to trusted IP ranges or VPN to reduce the attacker's ability to deliver crafted URLs to authenticated users; deploy a Content Security Policy (CSP) header on AEM responses that restricts script execution to known-safe origins, reducing the impact of any DOM XSS execution - note that AEM's rich authoring UI may require careful CSP tuning to avoid breaking legitimate functionality; and enforce multi-factor authentication on AEM accounts to raise the bar for obtaining the low-privilege credentials the CVSS PR:L prerequisite requires.