What is the CVSS score of EUVD-2026-35628?

EUVD-2026-35628 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager EUVD-2026-35628

| CVE-2026-47939 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-gmhm-cv6m-4rh7

XSS Adobe

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:31 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, and 2026.04 and earlier allows a low-privileged authenticated attacker to persistently inject malicious JavaScript into vulnerable form fields. When any user - including administrators - browses to the affected page, the injected script executes within their browser session. The CVSS Scope:Changed rating confirms the exploit crosses security boundaries: the attacker's injected payload affects victims beyond the attacker's own session, enabling session hijacking, credential theft, or privilege escalation in a CMS where administrators hold significant content control. No public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting) describes a failure to sanitize user-supplied input before rendering it in an HTML context. In this instance the variant is stored (persistent) XSS: the payload is saved to the AEM content repository and served to every subsequent visitor of the affected page, not just during the initial injection request. Adobe Experience Manager is a Java-based enterprise Web Content Management (WCM) and Digital Asset Management (DAM) platform widely deployed for marketing and corporate portals. The EUVD CPE-equivalent scope covers all AEM releases up to and including 2026.04, spanning both the legacy 6.5.x service-pack line and the cloud-native LTS/continuous-delivery lines. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C quantifies: network delivery, low complexity injection, low-privilege account required, one-click victim interaction, with impact crossing into a changed scope (victim browser context).

RemediationAI

The primary remediation is to apply the patch referenced in Adobe security bulletin APSB26-56 (https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html). Because the exact fixed version number is not confirmed in the available intelligence data, administrators should consult APSB26-56 directly to identify the target service pack or Cloud Manager release for their deployment track (6.5.x SP vs. LTS/2026.x). As an interim compensating control, restrict write access to vulnerable form fields to the minimum required set of trusted accounts, reducing the attacker pool available for injection. Additionally, enabling AEM's built-in XSS protection filter (AntiSamy/XSSAPI) for all user-editable rich-text and form components can limit injection surface; note this may affect legitimate rich-text authoring workflows and requires regression testing. For externally facing author environments, enforcing network-level access controls (VPN or IP allowlist) to AEM author instances reduces exposure to untrusted low-privilege accounts.