What is the CVSS score of EUVD-2026-35619?

EUVD-2026-35619 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager EUVD-2026-35619

| CVE-2026-47943 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-3mqx-256v-hfpr

XSS Adobe

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:29 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager (AEM) versions up to and including 6.5.24, LTS SP1, and 2026.04 allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user browses to the affected page, the script executes in their browser within a changed scope context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code has been identified at time of analysis, and the Adobe APSB26-56 advisory provides remediation guidance.

Technical ContextAI

Adobe Experience Manager is an enterprise content management and digital experience platform. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), meaning user-supplied input is persisted to a data store and later rendered without sufficient output encoding in a victim's browser. The CVSS Scope:Changed attribute confirms the injected script executes in the victim's browser origin rather than the attacker's session, which is the canonical behavior of stored XSS - the attacker compromises a trusted page that then weaponizes against any user who views it. Affected CPE per EUVD covers Adobe Experience Manager versions 0 through 2026.04, encompassing the traditional on-premise versioning (6.5.x LTS) and the cloud-native AEM as a Cloud Service release train (2026.04).

RemediationAI

Consult Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html for the official patch or release update. For AEM as a Cloud Service customers, Adobe typically delivers fixes automatically via the managed release pipeline - verify your environment is on a release later than 2026.04 once the fix version is published. For on-premise AEM 6.5 LTS deployments, apply the service pack or hotfix identified in APSB26-56; an exact patched version number was not independently confirmed from the available intelligence and should be verified directly against the advisory. As a compensating control prior to patching, restrict author-environment access to trusted contributor accounts only and audit existing form-field configurations for unsanitized stored content. Deploying a Web Application Firewall rule to detect and block XSS payloads in POST parameters destined for AEM authoring endpoints can reduce attack surface, though WAF rules should not be treated as a permanent substitute for the vendor patch.