Adobe
Monthly
Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 89.0%.
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.0%.
Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 26.2%.
Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.202.356 on Linux, allows remote attackers to execute. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 92.6%.
The Adobe Reader Mobile application before 11.2 for Android does not properly restrict use of JavaScript, which allows remote attackers to execute arbitrary code via a crafted PDF document, a related. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 90.3%.
Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 74.7%.
Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, Adobe AIR before 3.9.0.1380, Adobe AIR SDK before. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.4%.
Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.6%.
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 54.7%.
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 57.9%.
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 88.0%.
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before 11.2.202.262 on Linux, before 11.1.111.32 on Android 2.x and 3.x, and. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 90.3%.
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 83.3%.
Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified vectors, as exploited in the wild in January 2013. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 10.7%.
Adobe Flash Player before 10.3.183.19 and 11.x before 11.2.202.235 on Windows, Mac OS X, and Linux; before 11.1.111.9 on Android 2.x and 3.x; and before 11.1.115.8 on Android 4.x allows remote. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 90.1%.
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 16.3%.
Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote code execution, exploited as a zero-day in December 2011 through crafted PDF files.
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute arbitrary code via malicious SWF content, actively exploited in targeted attacks in April 2011.
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execution, exploited in the wild via Flash content embedded in Microsoft Office documents and web pages.
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was actively exploited as a zero-day in December 2009 via crafted PDF files with ZLib compressed streams.
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab object that allows remote attackers to execute arbitrary code via a crafted PDF argument.
Uncontrolled resource consumption in Adobe Acrobat Reader and Acrobat 2024 enables application-level denial of service when a victim opens a specially crafted document. Affecting Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383, the flaw (CWE-400) allows a malicious file to exhaust system resources and crash or freeze the application. Adobe has released patches via advisory APSB26-141; no public exploit or CISA KEV listing has been identified at time of analysis.
Incorrect Authorization (CWE-863) in Adobe Acrobat Reader and Acrobat 2024 allows unauthorized write access by bypassing document-level security restrictions when a victim opens a specially crafted PDF file. The CVSS scope-change indicator (S:C) signals the unauthorized write can escape the Acrobat process boundary and affect components outside the application itself, amplifying real-world impact beyond the medium base score. No public exploit has been identified and the vulnerability is not currently listed in the CISA KEV catalog.
Prototype Pollution in Adobe Acrobat and Acrobat Reader (versions through 26.002.21900 and Acrobat 2024 through 24.001.30383) allows an attacker who can deliver a crafted PDF to break out of the Reader's JavaScript sandbox and read arbitrary files from the victim's filesystem. The flaw abuses CWE-1321 to modify built-in JavaScript object prototypes inside Acrobat's scripting engine, subverting sandbox boundaries in a scope-changed exploit chain (S:C). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity once a victim opens the file elevates operational urgency for organizations reliant on Acrobat in document-heavy workflows.
Heap-based buffer overflow in Adobe Acrobat Reader (versions ≤26.002.21900 and Acrobat 2024 ≤24.001.30383) allows an attacker to disclose sensitive memory contents by delivering a crafted PDF file to a victim. The overflow is triggered during file parsing and results in out-of-bounds read of heap memory, enabling confidentiality compromise without integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained by the requirement for victim user interaction.
Out-of-bounds read in Adobe Acrobat and Acrobat Reader exposes sensitive process memory to attackers who can deliver malicious PDF files. Affected versions include Acrobat Reader and Acrobat 2024 up to 26.002.21900 and 24.001.30383 respectively. Exploitation requires a victim to open a crafted file, but no system privileges are needed - the barrier is solely user interaction, making phishing and email-borne delivery effective vectors.
Use-after-free in Adobe Acrobat Reader and Acrobat exposes sensitive heap memory contents when a victim opens a specially crafted PDF file. The vulnerability affects Acrobat and Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383, with confidentiality impact rated High by Adobe PSIRT. No public exploit code has been identified at time of analysis, and exploitation requires the victim to open a malicious file.
Out-of-bounds read in Adobe Acrobat Reader (≤26.002.21900) and Acrobat 2024 (≤24.001.30383) exposes sensitive process memory when a victim opens a specially crafted PDF file. The vulnerability stems from CWE-125, an out-of-bounds read, allowing an attacker who delivers a malicious document to obtain memory contents that could facilitate ASLR bypass or exfiltrate in-memory data such as document content or credentials. No public exploit has been identified at time of analysis; exploitation requires user interaction via file opening.
Out-of-bounds read in Adobe Acrobat Reader and Adobe Acrobat (all editions through version 26.002.21900, and Acrobat 2024 through 24.001.30383) enables sensitive process memory disclosure when a victim opens a specially crafted document. Rooted in CWE-125 improper bounds enforcement during file parsing, the flaw leaks adjacent memory contents including potential pointers or cached sensitive data. No active exploitation has been confirmed and no public proof-of-concept is known at time of analysis.
Integer underflow (CWE-191) in Adobe Acrobat Reader allows an attacker to disclose sensitive process memory contents by tricking a victim into opening a crafted PDF or Acrobat file. Affected across all current Acrobat 2024 (≤24.001.30383) and Acrobat/Acrobat Reader continuous-track (≤26.002.21900) releases. No active exploitation confirmed in CISA KEV; no public exploit code identified at time of analysis, though Adobe-class memory disclosure flaws are frequently chained with code execution primitives.
Use After Free (CWE-416) in Adobe Acrobat and Acrobat Reader permits sensitive memory disclosure when a victim opens a maliciously crafted document. Affected versions span Acrobat and Acrobat Reader ≤26.002.21900 and Acrobat 2024 ≤24.001.30383. The memory-corruption primitive exposes heap contents - potentially including credentials, key material, or in-process data - but the CVSS vector confirms no integrity or availability impact, making this a pure information-disclosure issue. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds read (CWE-125) in Adobe Acrobat and Acrobat Reader - versions up to 26.002.21900 and Acrobat 2024 up to 24.001.30383 - allows disclosure of sensitive process memory when a victim opens a specially crafted document file. The confidentiality impact is rated high (C:H), meaning leaked memory contents could include pointers, session data, or other in-process secrets, though there is no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Adobe has published advisory APSB26-141 addressing the issue.
Untrusted Search Path exploitation in Adobe Acrobat and Acrobat Reader allows a local attacker who already holds high privileges to gain unauthorized read access to sensitive confidential data under specific, attacker-uncontrollable environmental conditions. Affected products include Acrobat 2024 (≤24.001.30383), Acrobat Reader, and Adobe Acrobat (both ≤26.002.21900), per EUVD-2026-74105 and Adobe advisory APSB26-141. No public exploit code or active exploitation has been identified at time of analysis; exploitation mandates a victim open a malicious file and requires conditions beyond the attacker's direct control.
Out-of-bounds read in Adobe Acrobat Reader and Acrobat (Continuous Track ≤26.002.21900; Classic 2024 Track ≤24.001.30383) allows an attacker to disclose sensitive memory contents from a victim's process by delivering a crafted PDF file that the victim must open. The flaw is rooted in CWE-125 and carries a CVSS 5.5 score reflecting its local, user-interaction-dependent attack vector with high confidentiality impact but no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to permanently inject malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Affected deployments include AEM 6.5 LTS up to SP2, AEM 6.5 up to 6.5.24, and AEM as a Cloud Service up to 2026.7.0, per Adobe advisory APSB26-98. No public exploit or active exploitation has been identified at time of analysis, though the low-complexity attack path and broad AEM deployment make this a meaningful persistent threat in content-rich enterprise environments.
Stored Cross-Site Scripting in Adobe Experience Manager 6.5 LTS (≤SP2), AEM 6.5 (≤6.5.24), and AEM as a Cloud Service (≤2026.7.0) allows a low-privileged authenticated attacker to persist malicious JavaScript in vulnerable form fields of the authoring interface. When any other authenticated user visits the page containing the injected payload, the script executes in their browser under the site's origin with a changed scope, enabling session token theft or unauthorized actions on the victim's behalf. No public exploit code or active exploitation is identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who visits the affected page. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has released patches under advisory APSB26-98; no public exploit or CISA KEV listing is identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious scripts into vulnerable form fields. When any user - including administrators - subsequently browses the affected page, the injected JavaScript executes in their browser context, enabling session hijacking, credential theft, or UI redress attacks. Affected versions span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user-including administrators-browses a page containing the injected content, the script executes in their browser, enabling session hijacking, credential theft, or unauthorized actions under the victim's identity. The scope-changed CVSS vector confirms the attack crosses security boundaries, affecting users beyond the injecting account. No public exploit code and no CISA KEV listing are present at time of analysis.
Stored cross-site scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes silently in any victim's browser upon page load. The vulnerability spans AEM 6.5 up to 6.5.24, AEM 6.5 LTS up to SP2, and AEM as a Cloud Service up to build 2026.7.0, per Adobe security bulletin APSB26-98. Because the scope changes to the victim's browser context, a successful injection enables session token theft, credential harvesting, or further client-side attacks against any user - including administrators - who visits the poisoned content.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser when they navigate to the affected page. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through the 2026.7.0 release. The CVSS scope-change flag (S:C) signals that injected scripts escape the AEM application trust boundary and execute in the victim browser's security context; no public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields across the authoring interface. When any victim - including higher-privileged users such as administrators - browses to the page rendering the stored payload, the script executes in their browser, enabling session token theft, unauthorized content manipulation, or further actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis; Adobe has released fixes via security advisory APSB26-98.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which executes in any victim's browser that subsequently navigates to the affected page. The scope-changed CVSS vector (S:C) confirms that injected scripts operate within the victim's browser security context, enabling session hijacking, credential theft, or unauthorized AEM actions against higher-privileged users. Adobe has issued advisory APSB26-98 covering AEM as a Cloud Service, AEM 6.5, and AEM 6.5 LTS; no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Affected versions span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0), as documented in Adobe advisory APSB26-98. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser that renders the affected page. The vulnerability affects AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit code or active exploitation has been identified at time of analysis, and Adobe has addressed this in advisory APSB26-98.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any victim user browses to the affected page, the script executes in their browser within a changed scope context - enabling session theft, credential harvesting, or UI redressing against higher-privileged users. No public exploit code and no CISA KEV listing at time of analysis, but the low complexity and network accessibility make this straightforward to exploit by any authenticated user with form-submission rights.
Stored XSS in Adobe Experience Manager enables a low-privileged authenticated attacker to persistently inject malicious JavaScript into vulnerable form fields within the content authoring interface. When any user - including privileged editors or administrators - navigates to the affected page, the injected script executes in their browser session, potentially enabling session hijacking, credential theft, or unauthorized actions on their behalf. Adobe addressed this under advisory APSB26-98; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields. When any user-including administrators-visits the page containing the injected content, the script executes in their browser under a changed scope (S:C), enabling session theft, credential harvesting, or unauthorized actions on behalf of the victim. Affected are AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. No public exploit or active exploitation is identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields. When any user - including administrators - browses to pages containing the poisoned fields, the injected script executes in their browser under the AEM origin, enabling session token theft, credential harvesting, or UI redirection. Three deployment lines are affected: AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. No public exploit code or active exploitation has been identified at time of analysis.
Improper input validation in Adobe Experience Manager allows a low-privileged remote attacker to bypass a security feature and gain unauthorized limited write access to the platform. Affected deployments span AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 through 6.5.24. Exploitation requires social engineering - a logged-in victim must visit a crafted URL or interact with a compromised web page - constraining real-world reach. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables authenticated low-privilege attackers to inject and execute arbitrary JavaScript within a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope-changed CVSS vector indicates successful exploitation can cross session boundaries, enabling session token theft or unauthorized actions beyond the attacker's direct privilege level - though exploitation requires both a valid AEM credential and victim interaction via a crafted page. No public exploit code and no CISA KEV listing exist at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables authenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM sinks without sanitization. Affected releases span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe addressed this in security bulletin APSB26-98; no confirmed active exploitation or public proof-of-concept code has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated low-privilege attackers to execute arbitrary JavaScript in the browser context of targeted users who visit a crafted webpage. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through the 2026.7.0 release. Adobe addressed this in advisory APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by manipulating the DOM environment through a crafted webpage. Affected versions span AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 through 6.5.24. No public exploit code or active exploitation has been identified at time of analysis; vendor patch is documented under Adobe APSB26-98.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to inject malicious JavaScript that executes within a victim's browser context, with scope changing beyond AEM's own origin. Three product lines are affected: AEM 6.5, AEM 6.5 LTS, and AEM as a Cloud Service through their respective latest releases at time of disclosure. Exploitation requires user interaction - the victim must navigate to an attacker-crafted URL while authenticated - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM sinks. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), per Adobe advisory APSB26-98. The scope-changed CVSS vector indicates impact can extend beyond the AEM application boundary into the victim's broader browser session; no public exploit has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment via a crafted URL or webpage. All three AEM delivery models are affected - on-premises 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has published Security Bulletin APSB26-98 addressing this issue; no public exploit code and no CISA KEV listing have been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to execute arbitrary JavaScript within a victim's browser by enticing them to visit a crafted URL. All currently supported AEM deployment models are affected - Cloud Service through 2026.7.0, on-premises 6.5 through 6.5.24, and 6.5 LTS through SP2. The scope change in the CVSS vector indicates the JavaScript executes in a context beyond the vulnerable component itself, potentially enabling session hijacking or privilege escalation within the AEM environment. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
DOM-based XSS in Adobe Experience Manager enables an authenticated attacker to inject malicious JavaScript that executes within a victim's browser by manipulating client-side DOM sinks on crafted or attacker-influenced AEM pages. Affected deployments span AEM 6.5 on-premises through version 6.5.24, the 6.5 LTS track through SP2, and AEM as a Cloud Service through the 2026.7.0 release channel. Adobe has addressed the issue in advisory APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a network-adjacent, low-privileged attacker to execute arbitrary JavaScript within a victim's browser session by luring them to a crafted webpage. The vulnerability arises from unsanitized attacker-controlled data being written into the DOM without server-side involvement, enabling script execution in a changed security scope (S:C). Exploitation requires user interaction and no public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) enables an authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating client-side DOM sources and sinks via a crafted webpage. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 (≤6.5.24), and AEM 6.5 LTS (≤SP2), as confirmed by Adobe APSB26-98. The CVSS scope-change metric (S:C) indicates the payload escapes the AEM application context and can affect the victim's broader browser environment; no public exploit identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated, low-privileged attacker to execute arbitrary JavaScript in a victim's browser session by inducing that authenticated user to visit a crafted webpage. Affected versions span AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. The CVSS scope-change indicator (S:C) reflects that injected scripts execute within the victim's browser context, potentially enabling session theft, credential harvesting, or actions performed on behalf of the victim beyond the AEM application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to execute arbitrary JavaScript in a victim's browser by luring the victim to a crafted webpage. Affected are AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope-changed impact means the malicious script executes outside the originating application boundary, enabling session hijacking, credential theft, or UI redressing against authenticated AEM users. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary JavaScript within a victim's browser session by delivering a crafted URL that manipulates the client-side DOM environment. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The CVSS scope change (S:C) indicates the injected script executes in a different browser security context than the attacker's origin, enabling cross-context session abuse. No public exploit or CISA KEV listing is present at time of analysis.
DOM-based XSS in Adobe Experience Manager allows authenticated low-privileged attackers to inject malicious JavaScript into a victim's browser by luring them to a specially crafted URL that manipulates the client-side DOM without server-side involvement. Affected versions include AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has issued a fix under advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to inject and execute arbitrary JavaScript within a victim's browser by enticing them to visit a crafted URL or page, with scope change enabling cross-context impact. Affected versions include AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0, all addressed under Adobe Security Bulletin APSB26-98. No public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to inject malicious JavaScript into a victim's browser by manipulating the DOM environment through a crafted webpage. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit has been identified at time of analysis; Adobe has published security bulletin APSB26-98 addressing this issue.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to execute arbitrary JavaScript in a victim's browser by delivering a specially crafted URL or page that exploits client-side DOM processing. Affected are AEM 6.5 LTS through SP2, AEM 6.5 on-premise through 6.5.24, and AEM as a Cloud Service through the 2026.7.0 release. Successful exploitation enables session hijacking, credential theft, or unauthorized actions performed within the AEM environment on behalf of the victim, with scope change indicating impact crosses from the web application into the victim's browser context.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted webpage that manipulates the client-side DOM environment. The scope-changed CVSS vector (S:C) confirms the malicious script executes in the victim's browser security context rather than the server, enabling session hijacking, credential theft, or UI redress against AEM users. Reported directly by Adobe PSIRT and addressed in advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to manipulate client-side DOM variables to inject and execute arbitrary JavaScript within a victim's browser session. Affected are AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, per Adobe advisory APSB26-98. The scope change in the CVSS vector indicates that injected scripts can reach browser resources outside the AEM application origin, enabling session hijacking or cross-application data theft when a victim clicks a crafted link.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a network-accessible, low-privileged attacker to inject malicious JavaScript that executes entirely within a victim's browser session by manipulating the DOM environment. Affected versions span the AEM 6.5 branch (≤6.5.24), the 6.5 LTS edition (≤SP2), and AEM as a Cloud Service (≤2026.7.0), covering a broad enterprise install base. The CVSS vector confirms a scope change (S:C), meaning successful exploitation can affect browser resources beyond the originating AEM page - such as session tokens or cross-frame content - though user interaction via a crafted webpage visit is required for the attack to succeed.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) enables authenticated attackers with low-level access to inject malicious JavaScript into victim browsers, achieving a scope change that allows cross-origin script execution. Affected versions span AEM as a Cloud Service ≤2026.7.0, AEM 6.5 LTS ≤SP2, and AEM 6.5 ≤6.5.24, as confirmed by Adobe advisory APSB26-98. Exploitation requires user interaction; no public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject malicious JavaScript that executes inside a victim's browser when the victim visits a specially crafted URL or page hosted within the AEM environment. Affects AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. No public exploit identified at time of analysis; Adobe has released patches via advisory APSB26-98.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by directing the victim to a crafted webpage that manipulates the AEM client-side DOM environment. Affected releases span AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. The scope-changed impact means the injected script operates outside AEM's own origin boundary, enabling session theft or unauthorized actions against the authenticated victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) allows a low-privileged attacker to execute arbitrary JavaScript within a victim's browser by luring them to a crafted webpage that manipulates the client-side DOM environment. Affected versions span AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. The vulnerability carries a scope-change flag (S:C), indicating the injected script can affect browser context beyond AEM's own page, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating the DOM environment through a crafted webpage. Affected are AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit or KEV listing has been identified at time of analysis; exploitation requires both attacker authentication (PR:L) and victim interaction with a crafted URL or page.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript within a victim's browser by enticing them to visit a specially crafted URL. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the July 2026 (2026.7.0) release, with Adobe addressing this in security bulletin APSB26-98. The CVSS scope-change metric (S:C) reflects that successful exploitation crosses the AEM application boundary into the victim's browser context, enabling session hijacking, credential theft, or forced authenticated actions - no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject and execute arbitrary JavaScript in victims' browsers after social-engineering them into visiting a crafted webpage. Affected versions span AEM as a Cloud Service up to 2026.7.0, AEM 6.5 up to 6.5.24, and AEM 6.5 LTS up to SP2. The CVSS scope-change indicator (S:C) means injected scripts can reach browser contexts beyond the AEM origin, elevating potential impact to cross-origin session theft or privilege escalation within the CMS authoring environment. No public exploit or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2 enables authenticated low-privileged attackers to inject and execute arbitrary JavaScript in a victim's browser by manipulating the Document Object Model client-side. The scope change (S:C in the CVSS vector) confirms that successful exploitation escapes AEM's own security boundary, allowing the injected script to access browser-resident resources such as cookies, localStorage, or cross-origin-accessible DOM of other open pages. Exploitation requires a victim with a valid AEM session to be social-engineered into visiting a crafted URL, making this a realistic privilege-escalation vector from author/editor to administrator in enterprise AEM deployments. No public exploit code or CISA KEV listing identified at time of analysis; vendor advisory APSB26-98 is available.
Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 89.0%.
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.0%.
Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 26.2%.
Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.202.356 on Linux, allows remote attackers to execute. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 92.6%.
The Adobe Reader Mobile application before 11.2 for Android does not properly restrict use of JavaScript, which allows remote attackers to execute arbitrary code via a crafted PDF document, a related. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 90.3%.
Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 74.7%.
Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, Adobe AIR before 3.9.0.1380, Adobe AIR SDK before. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.4%.
Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.6%.
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 54.7%.
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 57.9%.
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 88.0%.
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before 11.2.202.262 on Linux, before 11.1.111.32 on Android 2.x and 3.x, and. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 90.3%.
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 83.3%.
Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified vectors, as exploited in the wild in January 2013. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 10.7%.
Adobe Flash Player before 10.3.183.19 and 11.x before 11.2.202.235 on Windows, Mac OS X, and Linux; before 11.1.111.9 on Android 2.x and 3.x; and before 11.1.115.8 on Android 4.x allows remote. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 90.1%.
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 16.3%.
Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote code execution, exploited as a zero-day in December 2011 through crafted PDF files.
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute arbitrary code via malicious SWF content, actively exploited in targeted attacks in April 2011.
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execution, exploited in the wild via Flash content embedded in Microsoft Office documents and web pages.
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was actively exploited as a zero-day in December 2009 via crafted PDF files with ZLib compressed streams.
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab object that allows remote attackers to execute arbitrary code via a crafted PDF argument.
Uncontrolled resource consumption in Adobe Acrobat Reader and Acrobat 2024 enables application-level denial of service when a victim opens a specially crafted document. Affecting Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383, the flaw (CWE-400) allows a malicious file to exhaust system resources and crash or freeze the application. Adobe has released patches via advisory APSB26-141; no public exploit or CISA KEV listing has been identified at time of analysis.
Incorrect Authorization (CWE-863) in Adobe Acrobat Reader and Acrobat 2024 allows unauthorized write access by bypassing document-level security restrictions when a victim opens a specially crafted PDF file. The CVSS scope-change indicator (S:C) signals the unauthorized write can escape the Acrobat process boundary and affect components outside the application itself, amplifying real-world impact beyond the medium base score. No public exploit has been identified and the vulnerability is not currently listed in the CISA KEV catalog.
Prototype Pollution in Adobe Acrobat and Acrobat Reader (versions through 26.002.21900 and Acrobat 2024 through 24.001.30383) allows an attacker who can deliver a crafted PDF to break out of the Reader's JavaScript sandbox and read arbitrary files from the victim's filesystem. The flaw abuses CWE-1321 to modify built-in JavaScript object prototypes inside Acrobat's scripting engine, subverting sandbox boundaries in a scope-changed exploit chain (S:C). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity once a victim opens the file elevates operational urgency for organizations reliant on Acrobat in document-heavy workflows.
Heap-based buffer overflow in Adobe Acrobat Reader (versions ≤26.002.21900 and Acrobat 2024 ≤24.001.30383) allows an attacker to disclose sensitive memory contents by delivering a crafted PDF file to a victim. The overflow is triggered during file parsing and results in out-of-bounds read of heap memory, enabling confidentiality compromise without integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained by the requirement for victim user interaction.
Out-of-bounds read in Adobe Acrobat and Acrobat Reader exposes sensitive process memory to attackers who can deliver malicious PDF files. Affected versions include Acrobat Reader and Acrobat 2024 up to 26.002.21900 and 24.001.30383 respectively. Exploitation requires a victim to open a crafted file, but no system privileges are needed - the barrier is solely user interaction, making phishing and email-borne delivery effective vectors.
Use-after-free in Adobe Acrobat Reader and Acrobat exposes sensitive heap memory contents when a victim opens a specially crafted PDF file. The vulnerability affects Acrobat and Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383, with confidentiality impact rated High by Adobe PSIRT. No public exploit code has been identified at time of analysis, and exploitation requires the victim to open a malicious file.
Out-of-bounds read in Adobe Acrobat Reader (≤26.002.21900) and Acrobat 2024 (≤24.001.30383) exposes sensitive process memory when a victim opens a specially crafted PDF file. The vulnerability stems from CWE-125, an out-of-bounds read, allowing an attacker who delivers a malicious document to obtain memory contents that could facilitate ASLR bypass or exfiltrate in-memory data such as document content or credentials. No public exploit has been identified at time of analysis; exploitation requires user interaction via file opening.
Out-of-bounds read in Adobe Acrobat Reader and Adobe Acrobat (all editions through version 26.002.21900, and Acrobat 2024 through 24.001.30383) enables sensitive process memory disclosure when a victim opens a specially crafted document. Rooted in CWE-125 improper bounds enforcement during file parsing, the flaw leaks adjacent memory contents including potential pointers or cached sensitive data. No active exploitation has been confirmed and no public proof-of-concept is known at time of analysis.
Integer underflow (CWE-191) in Adobe Acrobat Reader allows an attacker to disclose sensitive process memory contents by tricking a victim into opening a crafted PDF or Acrobat file. Affected across all current Acrobat 2024 (≤24.001.30383) and Acrobat/Acrobat Reader continuous-track (≤26.002.21900) releases. No active exploitation confirmed in CISA KEV; no public exploit code identified at time of analysis, though Adobe-class memory disclosure flaws are frequently chained with code execution primitives.
Use After Free (CWE-416) in Adobe Acrobat and Acrobat Reader permits sensitive memory disclosure when a victim opens a maliciously crafted document. Affected versions span Acrobat and Acrobat Reader ≤26.002.21900 and Acrobat 2024 ≤24.001.30383. The memory-corruption primitive exposes heap contents - potentially including credentials, key material, or in-process data - but the CVSS vector confirms no integrity or availability impact, making this a pure information-disclosure issue. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds read (CWE-125) in Adobe Acrobat and Acrobat Reader - versions up to 26.002.21900 and Acrobat 2024 up to 24.001.30383 - allows disclosure of sensitive process memory when a victim opens a specially crafted document file. The confidentiality impact is rated high (C:H), meaning leaked memory contents could include pointers, session data, or other in-process secrets, though there is no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Adobe has published advisory APSB26-141 addressing the issue.
Untrusted Search Path exploitation in Adobe Acrobat and Acrobat Reader allows a local attacker who already holds high privileges to gain unauthorized read access to sensitive confidential data under specific, attacker-uncontrollable environmental conditions. Affected products include Acrobat 2024 (≤24.001.30383), Acrobat Reader, and Adobe Acrobat (both ≤26.002.21900), per EUVD-2026-74105 and Adobe advisory APSB26-141. No public exploit code or active exploitation has been identified at time of analysis; exploitation mandates a victim open a malicious file and requires conditions beyond the attacker's direct control.
Out-of-bounds read in Adobe Acrobat Reader and Acrobat (Continuous Track ≤26.002.21900; Classic 2024 Track ≤24.001.30383) allows an attacker to disclose sensitive memory contents from a victim's process by delivering a crafted PDF file that the victim must open. The flaw is rooted in CWE-125 and carries a CVSS 5.5 score reflecting its local, user-interaction-dependent attack vector with high confidentiality impact but no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to permanently inject malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Affected deployments include AEM 6.5 LTS up to SP2, AEM 6.5 up to 6.5.24, and AEM as a Cloud Service up to 2026.7.0, per Adobe advisory APSB26-98. No public exploit or active exploitation has been identified at time of analysis, though the low-complexity attack path and broad AEM deployment make this a meaningful persistent threat in content-rich enterprise environments.
Stored Cross-Site Scripting in Adobe Experience Manager 6.5 LTS (≤SP2), AEM 6.5 (≤6.5.24), and AEM as a Cloud Service (≤2026.7.0) allows a low-privileged authenticated attacker to persist malicious JavaScript in vulnerable form fields of the authoring interface. When any other authenticated user visits the page containing the injected payload, the script executes in their browser under the site's origin with a changed scope, enabling session token theft or unauthorized actions on the victim's behalf. No public exploit code or active exploitation is identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who visits the affected page. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has released patches under advisory APSB26-98; no public exploit or CISA KEV listing is identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious scripts into vulnerable form fields. When any user - including administrators - subsequently browses the affected page, the injected JavaScript executes in their browser context, enabling session hijacking, credential theft, or UI redress attacks. Affected versions span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user-including administrators-browses a page containing the injected content, the script executes in their browser, enabling session hijacking, credential theft, or unauthorized actions under the victim's identity. The scope-changed CVSS vector confirms the attack crosses security boundaries, affecting users beyond the injecting account. No public exploit code and no CISA KEV listing are present at time of analysis.
Stored cross-site scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes silently in any victim's browser upon page load. The vulnerability spans AEM 6.5 up to 6.5.24, AEM 6.5 LTS up to SP2, and AEM as a Cloud Service up to build 2026.7.0, per Adobe security bulletin APSB26-98. Because the scope changes to the victim's browser context, a successful injection enables session token theft, credential harvesting, or further client-side attacks against any user - including administrators - who visits the poisoned content.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser when they navigate to the affected page. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through the 2026.7.0 release. The CVSS scope-change flag (S:C) signals that injected scripts escape the AEM application trust boundary and execute in the victim browser's security context; no public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields across the authoring interface. When any victim - including higher-privileged users such as administrators - browses to the page rendering the stored payload, the script executes in their browser, enabling session token theft, unauthorized content manipulation, or further actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis; Adobe has released fixes via security advisory APSB26-98.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which executes in any victim's browser that subsequently navigates to the affected page. The scope-changed CVSS vector (S:C) confirms that injected scripts operate within the victim's browser security context, enabling session hijacking, credential theft, or unauthorized AEM actions against higher-privileged users. Adobe has issued advisory APSB26-98 covering AEM as a Cloud Service, AEM 6.5, and AEM 6.5 LTS; no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Affected versions span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0), as documented in Adobe advisory APSB26-98. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser that renders the affected page. The vulnerability affects AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit code or active exploitation has been identified at time of analysis, and Adobe has addressed this in advisory APSB26-98.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any victim user browses to the affected page, the script executes in their browser within a changed scope context - enabling session theft, credential harvesting, or UI redressing against higher-privileged users. No public exploit code and no CISA KEV listing at time of analysis, but the low complexity and network accessibility make this straightforward to exploit by any authenticated user with form-submission rights.
Stored XSS in Adobe Experience Manager enables a low-privileged authenticated attacker to persistently inject malicious JavaScript into vulnerable form fields within the content authoring interface. When any user - including privileged editors or administrators - navigates to the affected page, the injected script executes in their browser session, potentially enabling session hijacking, credential theft, or unauthorized actions on their behalf. Adobe addressed this under advisory APSB26-98; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields. When any user-including administrators-visits the page containing the injected content, the script executes in their browser under a changed scope (S:C), enabling session theft, credential harvesting, or unauthorized actions on behalf of the victim. Affected are AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. No public exploit or active exploitation is identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields. When any user - including administrators - browses to pages containing the poisoned fields, the injected script executes in their browser under the AEM origin, enabling session token theft, credential harvesting, or UI redirection. Three deployment lines are affected: AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. No public exploit code or active exploitation has been identified at time of analysis.
Improper input validation in Adobe Experience Manager allows a low-privileged remote attacker to bypass a security feature and gain unauthorized limited write access to the platform. Affected deployments span AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 through 6.5.24. Exploitation requires social engineering - a logged-in victim must visit a crafted URL or interact with a compromised web page - constraining real-world reach. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables authenticated low-privilege attackers to inject and execute arbitrary JavaScript within a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope-changed CVSS vector indicates successful exploitation can cross session boundaries, enabling session token theft or unauthorized actions beyond the attacker's direct privilege level - though exploitation requires both a valid AEM credential and victim interaction via a crafted page. No public exploit code and no CISA KEV listing exist at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables authenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM sinks without sanitization. Affected releases span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe addressed this in security bulletin APSB26-98; no confirmed active exploitation or public proof-of-concept code has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated low-privilege attackers to execute arbitrary JavaScript in the browser context of targeted users who visit a crafted webpage. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through the 2026.7.0 release. Adobe addressed this in advisory APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by manipulating the DOM environment through a crafted webpage. Affected versions span AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 through 6.5.24. No public exploit code or active exploitation has been identified at time of analysis; vendor patch is documented under Adobe APSB26-98.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to inject malicious JavaScript that executes within a victim's browser context, with scope changing beyond AEM's own origin. Three product lines are affected: AEM 6.5, AEM 6.5 LTS, and AEM as a Cloud Service through their respective latest releases at time of disclosure. Exploitation requires user interaction - the victim must navigate to an attacker-crafted URL while authenticated - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM sinks. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), per Adobe advisory APSB26-98. The scope-changed CVSS vector indicates impact can extend beyond the AEM application boundary into the victim's broader browser session; no public exploit has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment via a crafted URL or webpage. All three AEM delivery models are affected - on-premises 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has published Security Bulletin APSB26-98 addressing this issue; no public exploit code and no CISA KEV listing have been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to execute arbitrary JavaScript within a victim's browser by enticing them to visit a crafted URL. All currently supported AEM deployment models are affected - Cloud Service through 2026.7.0, on-premises 6.5 through 6.5.24, and 6.5 LTS through SP2. The scope change in the CVSS vector indicates the JavaScript executes in a context beyond the vulnerable component itself, potentially enabling session hijacking or privilege escalation within the AEM environment. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
DOM-based XSS in Adobe Experience Manager enables an authenticated attacker to inject malicious JavaScript that executes within a victim's browser by manipulating client-side DOM sinks on crafted or attacker-influenced AEM pages. Affected deployments span AEM 6.5 on-premises through version 6.5.24, the 6.5 LTS track through SP2, and AEM as a Cloud Service through the 2026.7.0 release channel. Adobe has addressed the issue in advisory APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a network-adjacent, low-privileged attacker to execute arbitrary JavaScript within a victim's browser session by luring them to a crafted webpage. The vulnerability arises from unsanitized attacker-controlled data being written into the DOM without server-side involvement, enabling script execution in a changed security scope (S:C). Exploitation requires user interaction and no public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) enables an authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating client-side DOM sources and sinks via a crafted webpage. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 (≤6.5.24), and AEM 6.5 LTS (≤SP2), as confirmed by Adobe APSB26-98. The CVSS scope-change metric (S:C) indicates the payload escapes the AEM application context and can affect the victim's broader browser environment; no public exploit identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated, low-privileged attacker to execute arbitrary JavaScript in a victim's browser session by inducing that authenticated user to visit a crafted webpage. Affected versions span AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. The CVSS scope-change indicator (S:C) reflects that injected scripts execute within the victim's browser context, potentially enabling session theft, credential harvesting, or actions performed on behalf of the victim beyond the AEM application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to execute arbitrary JavaScript in a victim's browser by luring the victim to a crafted webpage. Affected are AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope-changed impact means the malicious script executes outside the originating application boundary, enabling session hijacking, credential theft, or UI redressing against authenticated AEM users. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary JavaScript within a victim's browser session by delivering a crafted URL that manipulates the client-side DOM environment. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The CVSS scope change (S:C) indicates the injected script executes in a different browser security context than the attacker's origin, enabling cross-context session abuse. No public exploit or CISA KEV listing is present at time of analysis.
DOM-based XSS in Adobe Experience Manager allows authenticated low-privileged attackers to inject malicious JavaScript into a victim's browser by luring them to a specially crafted URL that manipulates the client-side DOM without server-side involvement. Affected versions include AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has issued a fix under advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to inject and execute arbitrary JavaScript within a victim's browser by enticing them to visit a crafted URL or page, with scope change enabling cross-context impact. Affected versions include AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0, all addressed under Adobe Security Bulletin APSB26-98. No public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to inject malicious JavaScript into a victim's browser by manipulating the DOM environment through a crafted webpage. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit has been identified at time of analysis; Adobe has published security bulletin APSB26-98 addressing this issue.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to execute arbitrary JavaScript in a victim's browser by delivering a specially crafted URL or page that exploits client-side DOM processing. Affected are AEM 6.5 LTS through SP2, AEM 6.5 on-premise through 6.5.24, and AEM as a Cloud Service through the 2026.7.0 release. Successful exploitation enables session hijacking, credential theft, or unauthorized actions performed within the AEM environment on behalf of the victim, with scope change indicating impact crosses from the web application into the victim's browser context.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted webpage that manipulates the client-side DOM environment. The scope-changed CVSS vector (S:C) confirms the malicious script executes in the victim's browser security context rather than the server, enabling session hijacking, credential theft, or UI redress against AEM users. Reported directly by Adobe PSIRT and addressed in advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to manipulate client-side DOM variables to inject and execute arbitrary JavaScript within a victim's browser session. Affected are AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, per Adobe advisory APSB26-98. The scope change in the CVSS vector indicates that injected scripts can reach browser resources outside the AEM application origin, enabling session hijacking or cross-application data theft when a victim clicks a crafted link.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a network-accessible, low-privileged attacker to inject malicious JavaScript that executes entirely within a victim's browser session by manipulating the DOM environment. Affected versions span the AEM 6.5 branch (≤6.5.24), the 6.5 LTS edition (≤SP2), and AEM as a Cloud Service (≤2026.7.0), covering a broad enterprise install base. The CVSS vector confirms a scope change (S:C), meaning successful exploitation can affect browser resources beyond the originating AEM page - such as session tokens or cross-frame content - though user interaction via a crafted webpage visit is required for the attack to succeed.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) enables authenticated attackers with low-level access to inject malicious JavaScript into victim browsers, achieving a scope change that allows cross-origin script execution. Affected versions span AEM as a Cloud Service ≤2026.7.0, AEM 6.5 LTS ≤SP2, and AEM 6.5 ≤6.5.24, as confirmed by Adobe advisory APSB26-98. Exploitation requires user interaction; no public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject malicious JavaScript that executes inside a victim's browser when the victim visits a specially crafted URL or page hosted within the AEM environment. Affects AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. No public exploit identified at time of analysis; Adobe has released patches via advisory APSB26-98.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by directing the victim to a crafted webpage that manipulates the AEM client-side DOM environment. Affected releases span AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. The scope-changed impact means the injected script operates outside AEM's own origin boundary, enabling session theft or unauthorized actions against the authenticated victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) allows a low-privileged attacker to execute arbitrary JavaScript within a victim's browser by luring them to a crafted webpage that manipulates the client-side DOM environment. Affected versions span AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. The vulnerability carries a scope-change flag (S:C), indicating the injected script can affect browser context beyond AEM's own page, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating the DOM environment through a crafted webpage. Affected are AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit or KEV listing has been identified at time of analysis; exploitation requires both attacker authentication (PR:L) and victim interaction with a crafted URL or page.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript within a victim's browser by enticing them to visit a specially crafted URL. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the July 2026 (2026.7.0) release, with Adobe addressing this in security bulletin APSB26-98. The CVSS scope-change metric (S:C) reflects that successful exploitation crosses the AEM application boundary into the victim's browser context, enabling session hijacking, credential theft, or forced authenticated actions - no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject and execute arbitrary JavaScript in victims' browsers after social-engineering them into visiting a crafted webpage. Affected versions span AEM as a Cloud Service up to 2026.7.0, AEM 6.5 up to 6.5.24, and AEM 6.5 LTS up to SP2. The CVSS scope-change indicator (S:C) means injected scripts can reach browser contexts beyond the AEM origin, elevating potential impact to cross-origin session theft or privilege escalation within the CMS authoring environment. No public exploit or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2 enables authenticated low-privileged attackers to inject and execute arbitrary JavaScript in a victim's browser by manipulating the Document Object Model client-side. The scope change (S:C in the CVSS vector) confirms that successful exploitation escapes AEM's own security boundary, allowing the injected script to access browser-resident resources such as cookies, localStorage, or cross-origin-accessible DOM of other open pages. Exploitation requires a victim with a valid AEM session to be social-engineered into visiting a crafted URL, making this a realistic privilege-escalation vector from author/editor to administrator in enterprise AEM deployments. No public exploit code or CISA KEV listing identified at time of analysis; vendor advisory APSB26-98 is available.