EUVD-2026-35712
GHSA-r3mc-6vjj-wp7r
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
AnalysisAI
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, and 2026.04 and earlier allows a low-privileged authenticated attacker to inject and execute malicious JavaScript within a victim's browser by manipulating the client-side DOM environment. The CVSS scope change (S:C) is the critical risk amplifier here: injected script executes outside the originating component's security boundary, potentially enabling session hijacking, credential theft, or privilege escalation against higher-privileged AEM users such as administrators. This CVE is not listed in the CISA KEV catalog and no public exploit code has been identified at time of analysis.
Technical ContextAI
Adobe Experience Manager is an enterprise content management platform built on Apache Sling and OSGi, widely deployed for web content authoring and digital asset management. DOM-based XSS (CWE-79, Improper Neutralization of Input During Web Page Generation) differs from reflected or stored XSS in that the malicious payload is processed entirely client-side - attacker-controlled data flows into a DOM sink such as innerHTML, document.write, or eval without server-side sanitization, making server-side WAF rules largely ineffective. The CVSS vector's S:C (Scope Changed) component indicates the injected script can access security contexts beyond the vulnerable AEM component itself, such as the hosting domain's cookies, local storage, or co-hosted applications sharing the same origin. The affected version range per ENISA EUVD-2026-35712 covers all AEM releases up to and including 2026.04, spanning both the legacy 6.5.x LTS line and the cloud-native continuous delivery track.
RemediationAI
The primary remediation is to apply the patch documented in Adobe security advisory APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The exact patched release number (specific Service Pack or Cloud Service release) is not independently confirmable from the available input data - consult the advisory directly to identify the minimum fixed version for your deployment track (6.5.x LTS or AEM as a Cloud Service). As a compensating control prior to patching, restrict AEM Author environment access to trusted internal networks or VPN-only ingress; this prevents external attackers from delivering crafted URLs to privileged users and is the single highest-impact workaround available, though it does not address insider threat scenarios. Enabling a strict Content Security Policy (CSP) on AEM Author and Publish tiers can reduce DOM XSS impact by blocking inline script execution, but CSP configuration in AEM is non-trivial and requires regression testing against authoring UI components before deployment. Web Application Firewall rules offer limited protection for DOM-based XSS since payload processing is client-side, but may catch known payload patterns in URL parameters as a defense-in-depth measure.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today