EUVD-2026-35722
GHSA-m5r8-4x7h-8cwr
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
AnalysisAI
Stored XSS in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, and 2026.04 and earlier enables a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When a victim - potentially a higher-privileged user such as an administrator - browses to the affected page, the injected script executes in their browser context, enabling session token theft, credential harvesting, or actions performed on the victim's behalf. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis; however, the CVSS S:C (Scope Changed) designation signals that the real-world impact exceeds what the raw 5.4 Medium score implies, particularly in environments where low-privileged contributors can submit content reviewed by administrators.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) in its stored variant means the malicious payload is persisted server-side and served to every subsequent visitor of the compromised page, not just the attacker's own session. Adobe Experience Manager is an enterprise CMS built on Apache Sling and OSGi, widely deployed for large-scale digital content delivery. The vulnerability resides in form field rendering within AEM's authoring or content delivery layer, where user-supplied input is not adequately sanitized before being stored and later reflected into page output. The CVSS S:C (Scope Changed) flag is technically significant: it confirms the injected JavaScript executes in the victim's browser security context - a boundary separate from the AEM server - enabling cross-context attacks. Per EUVD-2026-35722, the affected version range is Adobe Experience Manager 0 through 2026.04, encompassing both the 6.5.x on-premise LTS track and the cloud/SaaS delivery model.
RemediationAI
Apply the fixes documented in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html - exact patched version numbers are not confirmed from the available input data, so consult the bulletin directly for the specific target versions for both the 6.5.x LTS track and the cloud/SaaS release line. As a compensating control pending patching, restrict AEM content authoring permissions so that only fully trusted users can submit content to form fields that render in administrative or privileged review views; this directly cuts off the attacker's ability to plant payloads where high-value victims will encounter them, though it may limit legitimate contributor workflows. Implementing a strict Content Security Policy (CSP) header - specifically restricting script-src to known trusted origins - can contain the impact of stored XSS even if injection succeeds, though CSP tuning in AEM environments requires testing to avoid breaking legitimate inline scripts used by AEM components. Web Application Firewall rules targeting common XSS payload patterns in POST request bodies provide an additional detection and blocking layer with low false-positive risk when properly tuned, but should not be treated as a primary mitigation given the ease of WAF bypass for sophisticated payloads.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today