EUVD-2026-35617
GHSA-ghx9-58mm-682c
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
AnalysisAI
Stored Cross-Site Scripting in Adobe Experience Manager (versions 6.5.24, LTS SP1, and 2026.04 and earlier) permits a low-privileged authenticated attacker to persistently inject malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. The CVSS scope change (S:C) indicates the injected script can impact browser contexts beyond AEM itself - enabling session hijacking, credential harvesting, or UI redress attacks against higher-privileged users such as administrators. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none with partial technical impact.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) describes a failure to sanitize user-supplied input before rendering it in a web page. In the stored (persistent) variant present here, the payload is written to the AEM content repository and re-executed every time the affected page is served, amplifying its reach compared to reflected XSS. Adobe Experience Manager is a Java-based enterprise CMS/DAM platform built on Apache Sling and OSGi; form field handling in its authoring UI or public-facing forms is the identified injection surface. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C confirms the attack is fully network-reachable, requires no special conditions beyond a low-privileged account, and that successful exploitation changes scope - meaning scripts can reach the victim's broader browser session, not just the AEM application origin. Affected versions span the 6.5.x LTS line through 6.5.24 SP1 and the cloud-native 2026.04 release, per both the NVD description and EUVD-2026-35617 (affected range: Adobe Experience Manager 0 ≤ 2026.04).
RemediationAI
The primary remediation is to apply the patch documented in Adobe security advisory APSB26-56, available at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The exact fixed version is not independently confirmed from the provided input data - consult APSB26-56 directly for the precise patched build applicable to your AEM track (6.5.x LTS or AEM as a Cloud Service). As a compensating control while patching, restrict write access to AEM form fields to the minimum required set of authenticated roles, reducing the pool of accounts that could be leveraged to inject payloads. Additionally, deploying a Web Application Firewall rule to detect and block common XSS payload patterns in AEM form submissions can reduce injection success rates, though this has the trade-off of potential false positives on rich-text content. Content Security Policy (CSP) headers scoped to the AEM domain can limit the damage from any injected script by restricting script sources, though implementing CSP in AEM without breaking authoring UI functionality requires careful testing.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today