EUVD-2026-35621
GHSA-5gw3-j69r-6rh9
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
AnalysisAI
Stored Cross-Site Scripting in Adobe Experience Manager (versions 6.5.24, LTS SP1, and 2026.04 and earlier) enables a low-privileged authenticated attacker to persist malicious JavaScript payloads inside vulnerable form fields. When a higher-privileged user - such as an administrator or editor - later browses the affected page, the injected script executes in their browser context, potentially enabling session hijacking, credential theft, or unauthorized actions on the victim's behalf. The CVSS Scope:Changed designation confirms the exploit transcends the attacker's own privilege boundary; no public exploit has been identified and CISA SSVC assessment rates exploitation as none at time of analysis.
Technical ContextAI
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), where user-supplied content in AEM form fields is persisted to the server without adequate output encoding and later reflected into page HTML viewed by other users. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C confirms the attack is network-reachable at low complexity, requires a low-privileged account, and produces a scope change - meaning the exploit crosses from the attacker's session context into the victim's browser environment. Adobe Experience Manager spans both on-premise distributions (6.5.x branch, LTS SP1) and cloud-managed deployments (2026.04 and earlier), covering a broad enterprise install base. EUVD-2026-35621 catalogues the affected range as AEM versions 0 through 2026.04 inclusive.
RemediationAI
The primary remediation is to apply the vendor-released patch documented in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. Patch availability is confirmed by the vendor advisory reference, but the exact patched version number was not included in the provided input data - consult APSB26-56 directly for the precise Service Pack or cloud release that resolves the issue. For AEM as a Cloud Service deployments, Adobe typically applies security patches automatically; administrators should verify their environment is current with the post-2026.04 release. On-premise customers running the 6.5.x branch or LTS SP1 must manually apply the corresponding Service Pack. As a compensating control pending patching, restrict content-authoring access to the minimum necessary set of trusted users, reducing the pool of accounts that could be used to inject payloads. Additionally, audit existing stored content in vulnerable form fields for injected script tags as a precautionary measure; this audit carries no service disruption risk.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today