EUVD-2026-35718
GHSA-3w6w-3mq9-wprw
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
AnalysisAI
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) 2026.04 and earlier enables a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user - including administrators - browses to a page containing the injected content, the script executes in their browser under a changed security scope (S:C), potentially compromising confidentiality and integrity of the victim's session. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, AEM's widespread enterprise deployment and the low barrier of entry (low-privilege account only) make this a meaningful risk in environments where untrusted or lightly vetted users have authoring or form-editing access.
Technical ContextAI
Adobe Experience Manager is an enterprise-grade content management and digital experience platform widely deployed in large organizations for web content authoring and delivery. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), meaning user-supplied input written to AEM form fields is persisted in the application's data store and subsequently rendered in browser contexts without adequate output encoding or sanitization. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N indicates network-accessible exploitation with low attack complexity, low privilege, but requiring victim interaction; the changed scope (S:C) is significant - it means the injected script can affect browser resources outside the vulnerable AEM component's own security context, such as cookies or content from other origins depending on same-site policies. Affected versions per ENISA EUVD-2026-35718 span all AEM releases through 2026.04, covering both the legacy 6.5.x LTS line and the cloud-native AEM as a Cloud Service track.
RemediationAI
The primary remediation is to apply the patch referenced in Adobe Security Bulletin APSB26-56, available at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. Patch available per vendor advisory; an exact patched release version was not independently confirmed in the available intelligence data - consult the APSB26-56 bulletin directly for the precise fixed build for your AEM track (6.5.x LTS or AEM as a Cloud Service). While awaiting patching, the most effective compensating control is to restrict the low-privileged authoring and form-editing roles to fully trusted internal users only, removing or suspending external contributors and third-party editors, since the vulnerability requires an authenticated low-privileged account. Additionally, enabling a strict Content Security Policy (CSP) on AEM delivery tiers can limit the impact of any executed XSS payload by restricting inline script execution and cross-origin data exfiltration, though CSP does not eliminate the underlying vulnerability. Web Application Firewall (WAF) rules targeting stored XSS patterns in AEM form submissions can provide a partial detection and blocking layer, but these have known bypass vectors and should not be treated as equivalent to patching.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today