Apache Sling XSS EUVD-2026-85176

Exploitation requires an application that uses the Apache Sling XSS Protection API (versions before 2.4.12) as its output-encoding/sanitization mechanism and renders attacker-influenced input through a code path where the library's neutralization is incomplete. Limiting factors: the attacker needs a reflected or stored injection point in the consuming application, victim user interaction (loading the affected page) is required for script execution, and applications that apply additional/independent output encoding or have upgraded to 2.4.12 are not exposed. Because no CVSS vector was published, whether the injection point itself requires authentication depends on the specific consuming application and is not confirmed from available data.

No CVSS score or vector was provided by Apache or NVD (both N/A), so severity signals must be inferred. The CWE-79 classification and product description confirm a genuine cross-site scripting flaw - notably a defect IN the Apache Sling XSS Protection API library itself (a sanitizer), meaning the neutralization routine fails to strip certain payloads, so applications relying on it as their sole XSS defense are exposed. EPSS is unavailable, the CVE is NOT in CISA KEV, and no public proof-of-concept was referenced; exploitation status is therefore 'no public exploit identified at time of analysis.' This is a moderate-priority defense-in-depth fix rather than an emergency: the standard XSS attack profile (remote, low complexity, but requiring victim interaction and reflected/stored injection context) plus the library's role behind Adobe AEM raises exposure, but there is no evidence of active or automated exploitation. Because the CVSS vector is missing, authentication requirements cannot be confirmed from the data - verify affected versions and impact against the Apache advisory before prioritizing.

An attacker submits input containing a script payload that the pre-2.4.12 Sling XSS API fails to fully neutralize, so it is reflected or stored into a rendered page of an application (e.g., an Adobe AEM/Sling site) that trusts the library for sanitization. When a victim views the page, the injected JavaScript executes in their browser session, enabling session/cookie theft or UI actions in the victim's context. No public exploit code was identified in the provided intelligence.