Adobe Experience Manager 6 5
Monthly
Arbitrary file system read in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets remote unauthenticated attackers traverse outside the intended directory scope to retrieve sensitive files, per Adobe advisory APSB26-74. The CVSS 3.1 score of 8.6 is elevated by a changed scope (S:C), meaning the read reaches resources beyond the vulnerable component's security authority. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Server-Side Request Forgery in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets a low-privileged, authenticated attacker coerce the server into issuing crafted requests that can escalate to arbitrary code execution in the current user's context and hijack the victim's account or session. The scope-changed CVSS 9.6 rating reflects that the SSRF pivots beyond the vulnerable component itself. No public exploit identified at time of analysis, and no CISA KEV listing; risk is driven by CVSS severity and Adobe's confirmation via advisory APSB26-74 rather than observed exploitation.
Sensitive file disclosure and potential account takeover in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6.5 LTS) arises from unsafe XML External Entity (XXE) processing that Adobe classifies as leading to arbitrary code execution in the current user's context. A low-privileged, authenticated attacker (PR:L) can trigger the flaw remotely over the network with no user interaction, reading protected files and pivoting to elevated access or session control. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.6 CVSS score and scope-change make it a high-priority patch.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who visits the affected page. All three deployment variants are affected - AEM 6.5 (≤6.5.24), AEM 6.5 LTS (≤SP1), and AEM as a Cloud Service (≤2026.5.0) - with patches released under Adobe advisory APSB26-74. No public exploit code or active exploitation has been identified; EPSS sits at 0.29% (21st percentile) and SSVC confirms exploitation status as none, placing this in a patch-on-schedule rather than emergency-response posture.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to inject and execute malicious JavaScript within a victim's browser by manipulating DOM-writable sinks in the AEM interface. Affected deployments span AEM as a Cloud Service (≤2026.5.0), AEM 6.5 LTS (≤SP1), and AEM 6.5 (≤6.5.24). No active exploitation has been identified - EPSS sits at 0.27% (19th percentile), CISA SSVC assigns exploitation status of 'none' and automatable 'no', and the vulnerability is absent from the CISA KEV catalog, collectively indicating low current threat momentum despite the scope-change component.
Stored Cross-Site Scripting in Adobe Experience Manager enables a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of any users who view the affected content - including administrators. Affected deployments span AEM as a Cloud Service through 2026.5.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP1. No public exploit identified at time of analysis; EPSS stands at 0.29% (21st percentile) and SSVC confirms no active exploitation, placing this in the medium-priority tier despite the scope-changed CVSS scoring.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to manipulate client-side DOM sources and execute arbitrary JavaScript within an authenticated victim's browser session. All three supported deployment tracks are affected: AEM as a Cloud Service (≤2026.5.0), AEM 6.5 LTS (≤SP1), and AEM 6.5 on-premises (≤6.5.24). No public exploit has been identified and SSVC classifies exploitation status as none, but patches are available across all affected tracks per Adobe advisory APSB26-74.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated network-accessible attackers to inject and execute arbitrary JavaScript within an authenticated victim's browser by delivering a crafted URL that manipulates the client-side DOM environment. All three AEM product tracks are affected: Cloud Service through 2026.5.0, the classic 6.5 series through 6.5.24, and 6.5 LTS through SP1. The CVSS scope change (S:C) reflects that execution escapes the vulnerable component into the victim's broader browser session, enabling session token theft or unauthorized AEM actions on the victim's behalf; however, no public exploit code has been identified at time of analysis and SSVC confirms no in-the-wild exploitation.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary JavaScript within a victim's browser by delivering a crafted URL that manipulates client-side DOM sources, contingent on the victim clicking the link. All three AEM product lines are affected - AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP1, and AEM as a Cloud Service through the 2026.5.0 release - with vendor-confirmed patches now available per advisory APSB26-74. No public exploit code has been identified and EPSS sits at 0.27% (19th percentile), consistent with SSVC's assessment of no current exploitation and non-automatable attack delivery.
Missing authentication in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6.5 LTS) lets a remote unauthenticated attacker reach a critical function directly, bypassing a security control to gain unauthorized write access. The CVSS 8.6 rating and scope-change flag indicate impact can extend beyond the initially vulnerable component, though only integrity is affected (no confidentiality or availability loss). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript within a victim's browser by delivering a crafted URL that manipulates the client-side DOM environment. Affected deployments span AEM 6.5 (≤6.5.24), AEM 6.5 LTS (≤SP1), and AEM as a Cloud Service (≤2026.5.0) - three distinct product lines with broad enterprise reach. No active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.27% at the 19th percentile alongside an SSVC exploitation status of 'none' indicate low near-term threat activity, though patching remains warranted given the changed-scope impact.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within an authenticated victim's browser session by manipulating client-side DOM data flows. Three product lines are confirmed affected: AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP1), and AEM as a Cloud Service (through 2026.5.0), with patched releases available per Adobe APSB26-74. No public exploit has been identified at time of analysis; EPSS at 0.27% (19th percentile) and SSVC 'Exploitation: none' collectively indicate low current exploitation pressure, though the confirmed scope change (S:C) elevates potential browser-level impact beyond the AEM application boundary.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute malicious JavaScript in a victim's authenticated browser session, affecting AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP1, and AEM as a Cloud Service through 2026.5.0. The changed-scope designation (S:C) in the CVSS 3.1 vector indicates that a successful exploit can affect resources beyond the originating AEM page context, enabling session hijacking or unauthorized content manipulation. No public exploit code or CISA KEV listing exists at time of analysis; EPSS is 0.27% (19th percentile), consistent with the SSVC assessment of no active exploitation and a non-automatable attack path.
Arbitrary file system read in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets remote unauthenticated attackers traverse outside the intended directory scope to retrieve sensitive files, per Adobe advisory APSB26-74. The CVSS 3.1 score of 8.6 is elevated by a changed scope (S:C), meaning the read reaches resources beyond the vulnerable component's security authority. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Server-Side Request Forgery in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets a low-privileged, authenticated attacker coerce the server into issuing crafted requests that can escalate to arbitrary code execution in the current user's context and hijack the victim's account or session. The scope-changed CVSS 9.6 rating reflects that the SSRF pivots beyond the vulnerable component itself. No public exploit identified at time of analysis, and no CISA KEV listing; risk is driven by CVSS severity and Adobe's confirmation via advisory APSB26-74 rather than observed exploitation.
Sensitive file disclosure and potential account takeover in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6.5 LTS) arises from unsafe XML External Entity (XXE) processing that Adobe classifies as leading to arbitrary code execution in the current user's context. A low-privileged, authenticated attacker (PR:L) can trigger the flaw remotely over the network with no user interaction, reading protected files and pivoting to elevated access or session control. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.6 CVSS score and scope-change make it a high-priority patch.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who visits the affected page. All three deployment variants are affected - AEM 6.5 (≤6.5.24), AEM 6.5 LTS (≤SP1), and AEM as a Cloud Service (≤2026.5.0) - with patches released under Adobe advisory APSB26-74. No public exploit code or active exploitation has been identified; EPSS sits at 0.29% (21st percentile) and SSVC confirms exploitation status as none, placing this in a patch-on-schedule rather than emergency-response posture.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to inject and execute malicious JavaScript within a victim's browser by manipulating DOM-writable sinks in the AEM interface. Affected deployments span AEM as a Cloud Service (≤2026.5.0), AEM 6.5 LTS (≤SP1), and AEM 6.5 (≤6.5.24). No active exploitation has been identified - EPSS sits at 0.27% (19th percentile), CISA SSVC assigns exploitation status of 'none' and automatable 'no', and the vulnerability is absent from the CISA KEV catalog, collectively indicating low current threat momentum despite the scope-change component.
Stored Cross-Site Scripting in Adobe Experience Manager enables a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of any users who view the affected content - including administrators. Affected deployments span AEM as a Cloud Service through 2026.5.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP1. No public exploit identified at time of analysis; EPSS stands at 0.29% (21st percentile) and SSVC confirms no active exploitation, placing this in the medium-priority tier despite the scope-changed CVSS scoring.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to manipulate client-side DOM sources and execute arbitrary JavaScript within an authenticated victim's browser session. All three supported deployment tracks are affected: AEM as a Cloud Service (≤2026.5.0), AEM 6.5 LTS (≤SP1), and AEM 6.5 on-premises (≤6.5.24). No public exploit has been identified and SSVC classifies exploitation status as none, but patches are available across all affected tracks per Adobe advisory APSB26-74.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated network-accessible attackers to inject and execute arbitrary JavaScript within an authenticated victim's browser by delivering a crafted URL that manipulates the client-side DOM environment. All three AEM product tracks are affected: Cloud Service through 2026.5.0, the classic 6.5 series through 6.5.24, and 6.5 LTS through SP1. The CVSS scope change (S:C) reflects that execution escapes the vulnerable component into the victim's broader browser session, enabling session token theft or unauthorized AEM actions on the victim's behalf; however, no public exploit code has been identified at time of analysis and SSVC confirms no in-the-wild exploitation.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary JavaScript within a victim's browser by delivering a crafted URL that manipulates client-side DOM sources, contingent on the victim clicking the link. All three AEM product lines are affected - AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP1, and AEM as a Cloud Service through the 2026.5.0 release - with vendor-confirmed patches now available per advisory APSB26-74. No public exploit code has been identified and EPSS sits at 0.27% (19th percentile), consistent with SSVC's assessment of no current exploitation and non-automatable attack delivery.
Missing authentication in Adobe Experience Manager (AEM as a Cloud Service, 6.5, and 6.5 LTS) lets a remote unauthenticated attacker reach a critical function directly, bypassing a security control to gain unauthorized write access. The CVSS 8.6 rating and scope-change flag indicate impact can extend beyond the initially vulnerable component, though only integrity is affected (no confidentiality or availability loss). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript within a victim's browser by delivering a crafted URL that manipulates the client-side DOM environment. Affected deployments span AEM 6.5 (≤6.5.24), AEM 6.5 LTS (≤SP1), and AEM as a Cloud Service (≤2026.5.0) - three distinct product lines with broad enterprise reach. No active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.27% at the 19th percentile alongside an SSVC exploitation status of 'none' indicate low near-term threat activity, though patching remains warranted given the changed-scope impact.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within an authenticated victim's browser session by manipulating client-side DOM data flows. Three product lines are confirmed affected: AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP1), and AEM as a Cloud Service (through 2026.5.0), with patched releases available per Adobe APSB26-74. No public exploit has been identified at time of analysis; EPSS at 0.27% (19th percentile) and SSVC 'Exploitation: none' collectively indicate low current exploitation pressure, though the confirmed scope change (S:C) elevates potential browser-level impact beyond the AEM application boundary.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute malicious JavaScript in a victim's authenticated browser session, affecting AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP1, and AEM as a Cloud Service through 2026.5.0. The changed-scope designation (S:C) in the CVSS 3.1 vector indicates that a successful exploit can affect resources beyond the originating AEM page context, enabling session hijacking or unauthorized content manipulation. No public exploit code or CISA KEV listing exists at time of analysis; EPSS is 0.27% (19th percentile), consistent with the SSVC assessment of no active exploitation and a non-automatable attack path.