What is the CVSS score of EUVD-2026-35629?

EUVD-2026-35629 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager EUVD-2026-35629

| CVE-2026-47956 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-hr7g-p6x3-c3hw

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:25 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser upon page visit. Affected versions span the 6.5.x LTS line through 6.5.24 and LTS SP1, as well as cloud-service releases through 2026.04. The CVSS Scope:Changed designation confirms the payload can affect browser contexts beyond the attacker's own session - elevating concern for privilege escalation against higher-privileged users such as administrators. No public exploit identified at time of analysis and no CISA KEV listing observed.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient sanitization or encoding of user-supplied input before it is stored and subsequently rendered as HTML content. Adobe Experience Manager (AEM) is an enterprise Java-based CMS and digital experience platform used for web content management, digital assets, and forms. The vulnerability resides in one or more form field rendering components where low-privileged users can author or submit content. Stored XSS is more severe than reflected XSS because the payload persists server-side and fires automatically for every user who visits the affected page, without requiring further attacker interaction after initial injection. EUVD-2026-35629 corroborates affected scope as all AEM releases at or below version 2026.04 (cloud) and 6.5.24/LTS SP1 (on-premise).

RemediationAI

Apply the update documented in Adobe security advisory APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The exact patched release version is not confirmed in the available intelligence data beyond the advisory reference - consult APSB26-56 directly for the specific target versions for both the 6.5.x on-premise line and the AEM as a Cloud Service 2026.04 release train. As compensating controls prior to patching: restrict the 'form field authoring' or equivalent content-contribution permissions to the minimum necessary set of user accounts to reduce the attacker surface for injection; deploy a Content Security Policy (CSP) header that restricts inline script execution and untrusted script origins - note CSP may break legitimate AEM JS functionality and requires testing before production deployment; and audit existing stored content in form fields for suspicious script tags as indicators of prior exploitation.