EUVD-2026-35622
GHSA-mq2q-567c-v6rg
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
AnalysisAI
Stored XSS in Adobe Experience Manager (versions 6.5.24, LTS SP1, and 2026.04 and earlier) allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields within the platform's content authoring interface. When a victim - typically an administrator or higher-privileged user - browses the page containing the injected field, the script executes in their browser, enabling session hijacking, credential theft, or unauthorized privileged actions. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, the changed scope (S:C) in the CVSS vector elevates the effective impact beyond the originating component, making this a meaningful risk in environments with untrusted low-privilege authors.
Technical ContextAI
Adobe Experience Manager (AEM) is an enterprise content management and digital asset management platform built on Apache Sling and OSGi, used extensively for web content authoring in large organizations. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): user-supplied input submitted via form fields is persisted to the AEM content repository (JCR) without adequate sanitization or output encoding, and is later rendered as raw HTML in victim browsers. The CVSS:3.1 vector AV:N/AC:L/PR:L/UI:R/S:C encodes several important technical facts: the attack is network-exploitable with low complexity; it requires a low-privileged AEM account (PR:L, consistent with standard author or contributor roles); it demands that a second user visit the affected page (UI:R); and critically, the scope is changed (S:C), meaning the injected script executes within the victim's browser security context rather than being confined to the AEM application's own origin - crossing a trust boundary. Affected versions span both the AEM Classic release train (through 6.5.24 and LTS SP1) and AEM as a Cloud Service (through 2026.04), as confirmed by ENISA EUVD-2026-35622.
RemediationAI
Apply the vendor-released patches documented in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. Adobe has confirmed patch availability for both the AEM 6.5 Classic release train (targeting 6.5.24 and LTS SP1) and AEM as a Cloud Service (2026.04 and earlier); exact patched build numbers must be verified directly from the advisory, as they are not enumerated in the available intelligence. As a compensating control pending patching, restrict content authoring and form-editing permissions to trusted, fully-vetted internal users only - removing write access from low-privileged or external contributor accounts eliminates the PR:L attack surface entirely. Additionally, implementing a strict Content Security Policy (CSP) header with a script-src allowlist on AEM publish and author instances can limit the impact of any injected scripts by preventing unauthorized script execution; note that AEM's authoring interface uses inline scripts extensively, so CSP deployment must be tested thoroughly in a staging environment to avoid breaking the authoring UI. AEM's built-in AntiSamy or HTML Library Manager (HtmlLM) output encoding should be verified as enabled for all affected field renderers.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today