Adobe
Monthly
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated remote attackers to execute arbitrary JavaScript in a victim's browser by manipulating the DOM environment of a crafted webpage the victim is induced to visit. Affected deployments span AEM 6.5 on-premises through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has released a remediation via advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute arbitrary JavaScript within a victim's browser session by manipulating the client-side DOM environment. Affected versions span the AEM 6.5 branch (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). Exploitation requires the attacker to hold a low-privileged AEM account and socially engineer a target user into visiting a crafted URL; no public exploit or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by manipulating the client-side DOM environment, achieving a scope change that can affect resources beyond the AEM origin. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), covering both cloud and on-premises enterprise installations. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires a victim to interact with a crafted webpage delivered by the attacker.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript in a victim's browser by inducing them to visit a crafted URL that manipulates client-side DOM sinks. Affected deployments span AEM 6.5 on-premises through version 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The CVSS scope-change (S:C) indicates injected scripts execute outside the vulnerable component's security boundary, enabling session theft or privileged action execution within the AEM browser origin. No public exploit or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript in a victim's browser session by luring the victim to a crafted URL or webpage. Affected deployments span Adobe Experience Manager 6.5 (through 6.5.24), Experience Manager 6.5 LTS (through SP2), and the Experience Manager as a Cloud Service (through the 2026.7.0 release). The scope-change designation confirms the malicious script executes outside the AEM server context - in the victim's browser - enabling session token theft, credential harvesting, or unauthorized AEM actions on behalf of the victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) enables a low-privileged authenticated attacker to inject malicious JavaScript into a victim's browser by manipulating client-side DOM sources before they reach execution sinks. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release; Adobe has addressed this through security advisory APSB26-98. The CVSS scope-change flag (S:C) reflects that successful exploitation crosses the boundary from the vulnerable AEM application into the victim's browser context, enabling session hijacking or unauthorized content manipulation on behalf of higher-privileged users.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated, low-privileged attacker to inject and execute malicious JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM sources. Affected deployments span AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 through 6.5.24. The CVSS scope-change designation (S:C) indicates injected script can reach browser context beyond the AEM application boundary; no public exploit has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by directing them to a crafted URL, with scope change enabling cross-context impact beyond the AEM application itself. Affected deployments span AEM 6.5 LTS up to SP2, AEM 6.5 up to version 6.5.24, and AEM as a Cloud Service up to the 2026.7.0 release. No public exploit code or active exploitation has been confirmed at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to inject and execute malicious JavaScript in a victim's browser by luring them to a crafted webpage that manipulates the client-side DOM environment. Affected are AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), per Adobe advisory APSB26-98. The scope-change designation (S:C) indicates injected scripts can reach browser resources beyond AEM's own application boundary, enabling session theft or cross-origin actions. No public exploit or CISA KEV listing is present at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM processing. Affected versions include AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. Exploitation requires user interaction (victim must visit the crafted page), and the scope change in the CVSS vector (S:C) confirms the attack can affect resources beyond the immediate AEM application context. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript within a victim's browser session after tricking that user into visiting a crafted page. The vulnerability spans AEM as a Cloud Service (≤2026.7.0), AEM 6.5 on-premises (≤6.5.24), and AEM 6.5 LTS (≤SP2), covering all major supported deployment tracks. Adobe has released remediation via Security Bulletin APSB26-98; no confirmed active exploitation or public exploit code is recorded at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables a low-privileged attacker to inject and execute arbitrary JavaScript within a victim's browser session by manipulating the DOM environment through a crafted webpage. The vulnerability affects AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, with scope change indicating the malicious script can reach beyond AEM's own security context into the victim's broader browser environment. Adobe has addressed this in advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject malicious JavaScript that executes within a victim's browser session by manipulating the DOM environment client-side. Affecting AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, exploitation requires the victim to visit a specially crafted webpage, making social engineering a necessary step. Adobe has released APSB26-98 addressing all three product lines; no public exploit or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privileged attackers to execute arbitrary JavaScript within a victim's browser by inducing them to visit a specially crafted AEM webpage, with the scope crossing the AEM origin boundary into the browser's security context. All three supported deployment tracks are affected: AEM as a Cloud Service through the 2026.7.0 release cycle, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. Adobe addressed this under advisory APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL or page that manipulates the client-side DOM. Affected deployments span AEM 6.5 on-premises (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0), covering a broad range of enterprise CMS installations. The scope-changed CVSS vector (S:C) signals that the script executes beyond the AEM application context - enabling session hijacking, credential theft, or action-on-behalf-of attacks targeting higher-privilege users. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to deliver a crafted URL that, when visited by an authenticated victim, executes arbitrary JavaScript within the victim's browser context with scope change across security boundaries. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. Adobe has released APSB26-98 addressing this issue; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript that executes entirely within a victim's browser, bypassing server-side defenses. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed classification (S:C) indicates the injected script can operate beyond the AEM application boundary in the victim's browser context, enabling session hijacking or credential theft from a higher-privileged user. No confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript that executes within a victim's browser session by luring them to a crafted webpage. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, with scope changed - meaning injected scripts can affect resources beyond the immediate AEM origin. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor advisory APSB26-98 covers remediation.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged remote attacker to execute malicious JavaScript in a victim's browser by luring the victim to a crafted URL or page that manipulates the client-side DOM environment. Affected versions span the entire AEM 6.5 line through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. Adobe has addressed this through APSB26-98; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated low-privileged attackers to execute arbitrary JavaScript in victims' browsers by crafting pages that manipulate the DOM environment. Affected deployments include AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. The scope-changed CVSS vector signals that script execution can cross component or trust boundaries within the victim's browser session. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0 allows low-privileged authenticated attackers to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Exploitation requires the victim to visit a crafted webpage, placing this in a social-engineering or insider-threat scenario rather than direct network exploitation. The scope change (S:C) in the CVSS vector confirms the JavaScript executes outside AEM's security boundary in the victim's browser context. No public exploit or CISA KEV listing is identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute arbitrary JavaScript within a victim's browser session by manipulating the DOM environment via a crafted webpage. Affected deployments span AEM as a Cloud Service through July 2026, AEM 6.5 through version 6.5.24, and AEM 6.5 LTS through SP2. No public exploit or active exploitation has been identified at time of analysis; the CVSS score of 5.4 reflects the authentication prerequisite and mandatory victim interaction, though the scope-changed rating indicates the injected script can affect resources outside the AEM application boundary.
DOM-based cross-site scripting in Adobe Experience Manager allows authenticated users to execute malicious JavaScript within their browser context by visiting a crafted webpage. The vulnerability affects AEM as a Cloud Service (up to version 2026.7.0) and on-premises versions (6.5 up to 6.5.24, 6.5 LTS through SP2). With scope changed, the attack can extend beyond the vulnerable component to affect other AEM systems or data. No public exploit code or active exploitation confirmed at time of analysis.
DOM-based cross-site scripting in Adobe Experience Manager 6.5 releases through version 6.5.24 and Cloud Service deployments through 2026.7.0 allows authenticated attackers to execute malicious JavaScript in victims' browsers by injecting attacker-controlled DOM manipulation code into shared content. Successful exploitation harvests session tokens, performs unauthorized actions as the victim, and accesses sensitive data within the victim's authorized scope. The attack requires both attacker authentication and victim user interaction with crafted pages; no active exploitation or public exploits identified at analysis time.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM as a Cloud Service through 2026.7.0 and on-premises AEM 6.5 through 6.5.24 and LTS through SP2. Exploitation requires that a low-privileged attacker socially engineer a target user into visiting a specially crafted URL or page; vendor advisory APSB26-98 confirms the issue and provides patched releases. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute malicious JavaScript within a victim's browser session by manipulating client-side DOM data without server-side interaction. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope-changed nature of the flaw means successful exploitation can affect browser resources beyond the AEM application boundary; no public exploit code or active exploitation has been identified at time of analysis.
Stored XSS in Adobe Experience Manager allows authenticated low-privileged attackers to inject malicious JavaScript into vulnerable form fields that later executes in victims' browsers when they visit the affected page. Affected deployments span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). Adobe has addressed this in security bulletin APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged, network-accessible attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Scope change (S:C) confirms the attack crosses from the application server context into the victim's browser security context, enabling session hijacking, credential theft, or further phishing within the authenticated AEM environment. No public exploit or KEV listing is present at time of analysis; CVSS 5.4 (Medium) reflects the privilege and user-interaction barriers that limit opportunistic mass exploitation.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to persistently inject malicious JavaScript into vulnerable form fields within the CMS. When any victim - including administrators - browses to the page containing the injected payload, the script executes in their browser session under the AEM application's trust boundary, with scope changing to the victim's context. Affected versions span AEM 6.5 ≤6.5.24, AEM as a Cloud Service ≤2026.7.0, and AEM 6.5 LTS ≤SP2, with remediation available via Adobe advisory APSB26-98. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript within a victim's browser by inducing them to visit a crafted URL. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 on-premises (≤6.5.24), as confirmed by EUVD-2026-74147 and Adobe APSB26-98. The scope-change rating reflects that injected script runs in the victim's browser security context, enabling session theft, credential harvesting, or UI redress attacks against higher-privileged users. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows an authenticated low-privileged attacker to inject and execute arbitrary JavaScript within victim browsers by crafting a malicious URL that manipulates the client-side DOM environment. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed CVSS vector (S:C) indicates the injected script can reach resources beyond the AEM application's own security boundary. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment via a crafted webpage. Affected deployments span AEM 6.5 on-premises (≤6.5.24), AEM 6.5 LTS (≤SP2), and AEM as a Cloud Service (≤2026.7.0), as documented in Adobe APSB26-98. The CVSS S:C scope-change designation confirms the payload can escape the vulnerable component's security boundary, enabling session hijacking or cross-origin data exfiltration against privileged AEM users. No public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager 6.5 (through 6.5.24), 6.5 LTS (through SP2), and Cloud Service (through 2026.7.0) enables an authenticated attacker to inject malicious JavaScript that executes in a victim's browser by manipulating client-side DOM state. The scope change (S:C) in the CVSS vector reflects that the injected script runs within the AEM domain's browser context, potentially reaching session tokens, saved credentials, or authoring capabilities beyond the attacker's original privilege level. Exploitation requires the attacker to hold a valid low-privilege AEM account and to socially engineer a victim into visiting a crafted URL; no public exploit code has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL that manipulates the DOM environment. Affected across AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). The scope-changed CVSS vector confirms the script executes outside the originating security context, enabling session theft, credential harvesting, or actions-on-behalf-of-victim against the AEM interface. No public exploit code or CISA KEV listing identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating client-side DOM sinks via a crafted URL. Scope change (S:C) means the injected script executes outside AEM's own origin context, enabling session token theft or privilege escalation against higher-privileged AEM users. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, per Adobe advisory APSB26-98. No public exploit or active exploitation is identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables an authenticated low-privileged attacker to inject and execute malicious JavaScript in a victim's browser by tricking them into visiting a specially crafted URL. The vulnerability spans AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, covering a broad enterprise install base. The CVSS scope-change flag (S:C) is the most significant risk amplifier, indicating injected scripts can reach security contexts beyond the originating AEM application. No public exploit or CISA KEV listing exists at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker with low privileges to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Because scope is changed (S:C per CVSS), the injected script can reach browser resources beyond the AEM origin, enabling session token theft or unauthorized actions performed as the victim. No public exploit code has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged remote attacker to execute malicious JavaScript in a victim's browser by manipulating the DOM environment of a crafted webpage. Affected versions span AEM 6.5 through 6.5.24, AEM as a Cloud Service through the 2026.7.0 release, and AEM 6.5 LTS through SP2. No public exploit or active exploitation has been identified at time of analysis; Adobe has issued advisory APSB26-98 with patch availability.
Stored Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of users who visit the affected pages. Affected deployments include AEM 6.5 through version 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the scope-changed CVSS vector indicates meaningful session and interface impact when exploited.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) allows an authenticated attacker to inject malicious JavaScript into a victim's browser by manipulating the DOM environment through a crafted webpage. The vulnerability affects AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, and carries a scope change meaning injected scripts execute beyond the attacker's origin context. No public exploit identified at time of analysis, and it is not listed in the CISA KEV catalog.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by luring them to a crafted webpage. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and the Cloud Service through the 2026.7.0 release. Scope is changed per the CVSS vector, meaning the exploit crosses the boundary from the AEM application context into the broader browser environment; no public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privilege authenticated attackers to execute arbitrary JavaScript in victims' browsers by delivering crafted URLs or pages that manipulate the client-side DOM environment. All supported AEM deployment modes are affected: on-premises 6.5.x through 6.5.24, 6.5 LTS through SP2, and Cloud Service through 2026.7.0. Adobe addressed this in security bulletin APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When a higher-privileged user (such as an administrator) browses the affected page, the script executes in their browser context, enabling session hijacking, credential theft, or UI redirection. The scope change (S:C in CVSS) signals that injected scripts can operate outside the application's own origin, amplifying the effective impact beyond the application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted webpage. The vulnerability spans Adobe Experience Manager as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), per APSB26-98. No active exploitation or public exploit code has been identified at time of analysis, though the scope-changed nature means successful exploitation can cross security boundaries within the victim's browser context.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated, low-privileged attacker to inject and execute arbitrary JavaScript in the browser session of any victim who visits a crafted AEM page. Affected are AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 on-premise through 6.5.24. The scope-changed CVSS rating (S:C) reflects that the injected script executes in the victim's browser context and can reach resources-such as session tokens and authenticated API calls-beyond the originating AEM page, amplifying the practical impact relative to the medium base score.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute malicious JavaScript within a victim's browser by delivering a crafted URL or page that manipulates the client-side DOM. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope change in the CVSS vector reflects that injected script executes beyond the originating component boundary, potentially enabling session theft or privilege escalation against higher-privileged AEM users. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) allows an authenticated attacker to execute arbitrary JavaScript within a victim's browser by enticing them to visit a crafted URL, affecting AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the July 2026 release. The CVSS scope change (S:C) signals that the injected script escapes AEM's own browser origin boundary, enabling session hijacking or unauthorized CMS operations under the victim's identity. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the broad enterprise footprint of AEM makes patching a priority.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user - including higher-privileged administrators - browses to the page containing the injected payload, the script executes in their browser context, crossing scope boundaries into the victim's session. Affected versions span AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2, as confirmed by APSB26-98. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser that subsequently visits the affected page. The scope-changed nature of this flaw (S:C in CVSS) means the attacker's script runs within the victim's browser security context, enabling session token theft, credential harvesting, or further client-side attacks. Affected deployments span AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2; no public exploit code or KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields within the CMS. When any user-including administrators-browses to a page containing the injected content, the script executes in their browser under a changed security context (S:C), enabling session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. Affected versions span AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2; no public exploit or active exploitation confirmed via CISA KEV at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields within the authoring environment. When any higher-privileged user subsequently browses the affected page, the script executes in their browser within a changed scope, potentially enabling session theft or unauthorized actions. Adobe has issued advisory APSB26-98 covering AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0; no public exploit or CISA KEV listing has been identified.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to persist malicious JavaScript payloads in vulnerable form fields, which then execute in any victim's browser upon page visit. Affected versions span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). Adobe has addressed the issue in security bulletin APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
Stored XSS in Adobe Experience Manager permits low-privileged authenticated users to inject persistent JavaScript payloads into vulnerable form fields within the CMS authoring interface. When any user - including administrators - browses a page containing the injected field, their browser executes the attacker's script in the context of the AEM domain, with scope change confirming cross-boundary impact. All AEM 6.5 versions through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 build are affected; remediation is available via Adobe APSB26-98. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of other users - including administrators - when they visit the affected page. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit or CISA KEV listing has been identified at time of analysis; the scope-changed CVSS vector reflects the cross-user browser impact.
Stored XSS in Adobe Experience Manager allows low-privileged authenticated attackers to inject malicious JavaScript into vulnerable form fields, where it persists server-side and executes in any victim's browser upon visiting the affected page. Three release tracks are affected: AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. The scope-changed impact means attacker-controlled scripts run in victim browser contexts - including those of administrators - enabling session hijacking, credential theft, or unauthorized actions on behalf of higher-privileged users. No public exploit or CISA KEV listing identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser when they navigate to the affected page. Affected deployments span AEM 6.5 through 6.5.24 and 6.5 LTS through SP2 (on-premises), as well as AEM as a Cloud Service through the July 2026 release (2026.7.0). Adobe has published advisory APSB26-98 confirming the scope-changed impact; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields that persists and executes in the browsers of other users who visit the affected page. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed nature of the vulnerability means the attacker's payload crosses from the AEM application context into victim browser sessions, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to manipulate client-side DOM processing and execute arbitrary JavaScript in a victim's browser session. Affected deployments span AEM 6.5 up to version 6.5.24, AEM 6.5 LTS up to SP2, and AEM as a Cloud Service up to release 2026.7.0. Exploitation requires convincing an authenticated victim to visit a specially crafted URL; scope is changed because the injected script runs in the victim's browser context outside the AEM application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis; Adobe has issued patches under advisory APSB26-98.
Path traversal in Adobe Photoshop Mobile for Android (≤1.6.0.2294 and ≤1.6.0.2299) enables a low-privileged attacker to cause a security feature bypass, reading unauthorized files or directories outside the app's intended sandbox and producing high availability impact when a victim opens a maliciously crafted Photoshop document. The CVSS 3.1 score of 5.0 captures the meaningful constraints: local attack vector, high complexity, required user interaction, and the fact that exploitation depends on conditions beyond the attacker's control. No active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis.
Out-of-bounds read in Adobe DNG SDK 1.7.1 2502 and earlier exposes sensitive memory contents when a victim opens a maliciously crafted DNG file. The flaw resides in the SDK's file parser and affects any application built on top of the DNG SDK that processes untrusted DNG inputs. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, limiting current urgency despite the High confidentiality impact.
Out-of-bounds write in Adobe DNG Software Development Kit versions 1.7.1 2502 and earlier allows memory corruption when a victim opens a maliciously crafted DNG file, causing the consuming application to crash or become unresponsive. The flaw (CWE-787) is constrained to a local, user-interaction-dependent attack path, limiting automated exploitation. No public exploit code has been identified at time of analysis and no CISA KEV listing exists.
Out-of-bounds read in Adobe Substance 3D Painter exposes sensitive process memory when a victim opens a specially crafted malicious file. The flaw, classified as CWE-125, causes the application to read beyond allocated buffer boundaries during file parsing, potentially leaking in-memory data such as credentials or session tokens accessible to the attacker. Adobe has published security advisory APSB26-129 addressing the issue; no public exploit code has been identified at time of analysis.
Out-of-bounds read in Adobe Illustrator Desktop 2025 and 2026 exposes sensitive process memory to disclosure when a victim opens a specially crafted file. The vulnerability carries a CVSS 3.1 score of 5.5 (Medium) with a local attack vector and required user interaction, limiting opportunistic exploitation but making it viable in targeted social-engineering campaigns. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Substance3D - Designer crashes on availability when a victim opens a specially crafted malicious file, triggering a NULL Pointer Dereference that terminates the application. Adobe Substance 3D Designer users across all tracked versions (CPE wildcard) are affected, with impact limited to application-level denial of service - no code execution, data disclosure, or integrity compromise is possible. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, consistent with its low exploitability ceiling (requires local victim interaction).
Integer underflow in Adobe's Content Credentials Rust SDK and c2pa_tool allows a local attacker to crash the application via a crafted C2PA manifest, causing a denial-of-service condition. Both the standalone CLI tool (c2pa_tool) and the Rust SDK library (content_credentials_rust_sdk) are affected per CPE data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the absence of user interaction requirement lowers the bar for automated or scripted triggering.
Integer underflow (CWE-191) in Adobe's Content Credentials Rust SDK and C2PA Tool crashes the application when processing a specially crafted C2PA manifest, producing a denial-of-service condition. Both the c2pa_tool and content_credentials_rust_sdk components are confirmed affected per Adobe advisory APSB26-110. No public exploit code or active exploitation has been identified; impact is limited entirely to application availability with no confidentiality or integrity consequences.
Arbitrary file system read in Adobe's Content Credentials (C2PA Tool and Content Credentials Rust SDK) exposes sensitive files and directories outside the intended access scope through improper input validation during file parsing. The attack requires a victim to open a malicious file crafted by the attacker, making this a local, user-interaction-dependent vulnerability with high confidentiality impact but no integrity or availability consequence. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis.
Path traversal in dekdee's adobe-xd-mcp 1.0.0 exposes the server filesystem to remote unauthenticated attackers via unsanitized `outputFile` and `outputDir` parameters in the `file-access-from-request` endpoint of `src/parsers/xd-parser.ts`. A public proof-of-concept exploit is available through the project's GitHub issue tracker, and no patch has been released - the vendor has not responded to the disclosure. With a CVSS 4.0 score of 6.9, public exploit code (E:P), and no mitigating authentication requirement, any network-exposed instance is immediately at risk.
Privilege escalation in Adobe Commerce and Magento Open Source exposes restricted resources to authenticated high-privilege users through a flawed authorization check (CWE-863). Affected products span the full 2.4.x series of Adobe Commerce and Magento Open Source, plus the 1.3.x-1.5.x Adobe Commerce B2B extension. No public exploits are known, CISA SSVC rates exploitation as none, and vendor-released August 2026 patches are available across all affected release lines per advisory APSB26-92.
Incorrect Authorization in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B allows a network-accessible, high-privileged attacker to bypass platform security controls and gain unauthorized write access, resulting in high integrity and availability impacts. Affected are Adobe Commerce through 2.4.9-2026-jul, Magento Open Source through 2.4.9-2026-jul, and Adobe Commerce B2B through 1.5.3-2026-jul, with August 2026 patches available per Adobe APSB26-92. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Improper input validation in Adobe's Content Credentials ecosystem (Rust SDK, JS SDK, and CLI tool) allows local attackers to bypass C2PA content authenticity security controls and gain unauthorized limited write access to credential metadata. Affected are c2pa-v0.90.5 and earlier, @contentauth/c2pa-web@0.12.0 and earlier, and c2patool-v0.27.5 and earlier. No user interaction is required, but the local attack vector (AV:L) and SSVC automation rating of 'no' constrain realistic exploitation to targeted scenarios rather than mass exploitation.
Integer underflow (CWE-191) in Adobe's Content Credentials ecosystem - covering the Rust SDK (c2pa), JavaScript SDK (@contentauth/c2pa-web), and CLI tool (c2patool) - allows a local attacker to crash any application that processes a specially crafted content credential payload, producing a denial-of-service condition. All three components share the underlying parsing logic and are affected up to their respective patch releases. No public exploit or CISA KEV listing has been identified at time of analysis, but the availability of patched versions and a vendor advisory (APSB26-111) confirms vendor-acknowledged impact.
Path traversal in Adobe's CAI Content Credentials ecosystem - spanning the Rust SDK (c2pa-v0.90.5 and earlier), the JavaScript/Web SDK (@contentauth/c2pa-web@0.12.0 and earlier), and the c2patool command-line utility (v0.27.5 and earlier) - enables arbitrary file system reads outside the intended access scope. The flaw is triggered when a victim processes a maliciously crafted file or visits a compromised web page that causes the SDK to resolve attacker-controlled path sequences. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; patched releases exist for all three components.
Integer overflow in Adobe's CAI Content Credentials SDK family (Rust, JavaScript, and CLI) allows a local attacker to crash the application, producing a denial-of-service condition. All three components - the Rust c2pa crate, the JS c2pa-web package, and the c2patool command-line utility - share the same CWE-190 root cause and are affected up to their respective boundary versions. No public exploit code or active exploitation has been identified; Adobe has released patched versions for all three components per advisory APSB26-111.
Integer overflow in Adobe's Content Credentials ecosystem - spanning the Rust SDK (c2pa ≤ v0.90.5), JavaScript SDK (@contentauth/c2pa-web ≤ 0.12.0), and the c2patool CLI (≤ v0.27.5) - allows denial-of-service through application crash when processing maliciously crafted C2PA assets. The CVSS:3.1/AV:L vector indicates the exploitable surface is file or data ingestion rather than a directly exposed network service, requiring no user interaction or privileges once a crafted asset reaches the parsing pipeline. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Uncontrolled resource consumption in Adobe's CAI Content Credentials ecosystem (c2patool CLI, Rust SDK, and JS SDK) allows a local attacker to trigger application denial-of-service by supplying crafted input that exhausts system resources. Three distinct release artifacts are affected: the c2patool command-line utility, the c2pa Rust crate, and the @contentauth/c2pa-web JavaScript SDK, all patched in a coordinated Adobe PSIRT disclosure (APSB26-111). No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as 'none' with non-automatable attack conditions.
Certificate validation bypass in Adobe's Content Credentials SDK undermines the C2PA provenance chain across three SDK variants - JavaScript/WASM (@contentauth/c2pa-web through 0.12.0), Rust (c2pa through v0.90.5), and CLI (c2patool through v0.27.5) - allowing an attacker-controlled certificate to be accepted as legitimate when a victim visits a malicious URL or interacts with a compromised web page. Successful exploitation grants unauthorized write access to content credentials, enabling an attacker to forge provenance metadata and defeat the product's core integrity guarantee. No public exploit has been identified at time of analysis; vendor-released patches exist for all three affected SDK variants.
Improper input validation across Adobe's Content Credentials JS SDK, Rust SDK, and command-line tool allows a remote unauthenticated attacker to bypass integrity verification and gain unauthorized write access to C2PA-signed content metadata. All three SDK components prior to their respective patch releases are affected, and exploitation requires a victim to visit a maliciously crafted URL or interact with a compromised web page. No public exploit code or active exploitation has been identified at time of analysis, though the write-impact on content authenticity signals carries meaningful trust implications for downstream consumers.
Integer underflow in Adobe's Content Credentials SDK crashes any application that parses a specially crafted C2PA manifest file, producing a denial-of-service condition. The Rust crate (c2pa ≤0.90.5), JavaScript/WASM package (@contentauth/c2pa-web ≤0.12.0), and CLI tool (c2patool ≤0.27.5) are all affected, with patched releases confirmed by Adobe advisory APSB26-111. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact is highest in automated media ingestion pipelines that validate C2PA provenance on user-supplied files.
Uncontrolled resource consumption in Adobe's Content Credentials ecosystem - spanning the c2patool CLI (≤v0.27.5), Rust SDK c2pa (≤v0.90.5), and JavaScript SDK @contentauth/c2pa-web (≤v0.12.0) - allows a local attacker without elevated privileges to exhaust system resources and cause an application denial-of-service. The vulnerability does not require user interaction, lowering the bar for exploitation in automated pipelines. Adobe has released patches across all three components via advisory APSB26-111, and no public exploit code or active exploitation has been identified at time of analysis.
Integer overflow in Adobe's Content Credentials SDK and CLI toolchain crashes the application when processing crafted input, resulting in a denial-of-service condition. Affected components span the Rust SDK (c2pa), the command-line tool (c2patool), and the JavaScript/WebAssembly SDK (@contentauth/c2pa-web), all at versions prior to their respective patch releases. No public exploit has been identified at time of analysis, and SSVC assesses exploitation as none with non-automatable delivery.
SSRF with privilege escalation affects Adobe's Content Credentials SDK and CLI toolchain, enabling a network-based attacker to induce the victim's client to issue server-side requests to unintended internal or external targets. Exploitation requires user interaction - a victim must visit a crafted URL or engage with a compromised web page - but the CVSS scope change (S:C) indicates the vulnerability can reach beyond the directly vulnerable component to affect other systems or services. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Improper input validation in Adobe ColdFusion 2023 and 2025 allows a remote attacker holding high-privileged credentials to crash the application server via a crafted network request, producing a denial-of-service condition. Affected versions are ColdFusion 2023 ≤ 2023.0.22 and ColdFusion 2025 ≤ 2025.0.11, with vendor-released patches documented in Adobe Security Bulletin APSB26-90. No public exploit code or confirmed active exploitation has been identified at time of analysis.
ColdFusion 2023 and 2025 contain an Incorrect Authorization flaw (CWE-863) that allows any low-privileged authenticated user to remotely crash the application server, producing a denial-of-service condition. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation requires only network access and a valid low-privilege credential with no interaction from other users, making repeated service disruption trivial for any credentialed attacker. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored XSS in Adobe ColdFusion 2023 (≤2023.0.22) and 2025 (≤2025.0.11) allows a low-privileged attacker to persist malicious JavaScript in vulnerable form fields, which then executes in the browsers of other users who view the affected page. The CVSS scope change (S:C) reflects that injected scripts can impact users beyond the attacker's own session - including potentially higher-privileged administrators. No public exploit code exists and CISA has not listed this in KEV; SSVC rates exploitation as none and technical impact as partial at time of analysis.
ColdFusion 2023 and ColdFusion 2025 contain an improper output encoding flaw (CWE-116) enabling low-privileged network attackers to circumvent security controls, achieve limited unauthorized write access, and cause modest availability disruption. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack is network-reachable, requires only a low-privileged account, and needs no user interaction. No public exploit code has been identified and CISA SSVC assigns exploitation status of none; vendor-released patches are available as ColdFusion 2023 update 2023.0.23 and ColdFusion 2025 update 2025.0.12 per Adobe advisory APSB26-90.
SAP NetWeaver AS Java's Adobe Document Services (ADS) component ships outdated open-source cryptographic and data transfer libraries that carry known, unpatched-within-the-product vulnerabilities classified under CWE-1395. Low-privileged authenticated attackers with network access can exploit these library weaknesses to achieve limited impact across confidentiality, integrity, and availability of the affected ADS component. No public exploit code or active exploitation has been identified; this is a supply-chain dependency risk with a CVSS 6.3 Medium score and no indication of weaponization at time of analysis.
Adobe Genuine Software Integrity Service on local systems exposes an Incorrect Authorization flaw (CWE-863) enabling any local attacker - without elevated privileges - to bypass the service's integrity-verification controls and obtain unauthorized limited write access to areas the service is designed to protect. All tracked versions of the service are affected per the open-ended CPE range published by Adobe. No public exploit or CISA KEV listing has been identified at time of analysis, and exploitation is constrained to the local environment, reducing mass-exploitation risk while remaining a realistic threat from malware, shared-account misuse, or low-privileged insider scenarios.
Uncontrolled resource consumption in Adobe's C2PA Content Credentials Rust SDK, CLI tool (c2patool), and JavaScript web SDK allows a local attacker supplying a crafted input to exhaust system resources and crash the application. All three library families are affected across distinct runtimes - Rust, Node.js, and native binary - with patched releases available for each. No public exploit exists, SSVC classifies exploitation as none, and EPSS sits at the 5th percentile, indicating low real-world exploitation pressure despite the zero-user-interaction requirement.
Integer overflow in Adobe's Content Credentials SDK family (c2pa Rust SDK, c2pa-web JS SDK, and c2patool CLI) allows a local attacker to crash any application that processes a specially crafted C2PA manifest, resulting in denial of service. All three components share the vulnerable parsing logic and are affected across versions up to c2pa-v0.84.0, @contentauth/c2pa-web@0.7.0, and c2patool-v0.16.5 respectively. No public exploit exists and SSVC confirms no observed exploitation; however, patches are available and should be applied given the zero-privilege-required local trigger condition.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated remote attackers to execute arbitrary JavaScript in a victim's browser by manipulating the DOM environment of a crafted webpage the victim is induced to visit. Affected deployments span AEM 6.5 on-premises through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has released a remediation via advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute arbitrary JavaScript within a victim's browser session by manipulating the client-side DOM environment. Affected versions span the AEM 6.5 branch (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). Exploitation requires the attacker to hold a low-privileged AEM account and socially engineer a target user into visiting a crafted URL; no public exploit or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by manipulating the client-side DOM environment, achieving a scope change that can affect resources beyond the AEM origin. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), covering both cloud and on-premises enterprise installations. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires a victim to interact with a crafted webpage delivered by the attacker.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript in a victim's browser by inducing them to visit a crafted URL that manipulates client-side DOM sinks. Affected deployments span AEM 6.5 on-premises through version 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The CVSS scope-change (S:C) indicates injected scripts execute outside the vulnerable component's security boundary, enabling session theft or privileged action execution within the AEM browser origin. No public exploit or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript in a victim's browser session by luring the victim to a crafted URL or webpage. Affected deployments span Adobe Experience Manager 6.5 (through 6.5.24), Experience Manager 6.5 LTS (through SP2), and the Experience Manager as a Cloud Service (through the 2026.7.0 release). The scope-change designation confirms the malicious script executes outside the AEM server context - in the victim's browser - enabling session token theft, credential harvesting, or unauthorized AEM actions on behalf of the victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) enables a low-privileged authenticated attacker to inject malicious JavaScript into a victim's browser by manipulating client-side DOM sources before they reach execution sinks. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release; Adobe has addressed this through security advisory APSB26-98. The CVSS scope-change flag (S:C) reflects that successful exploitation crosses the boundary from the vulnerable AEM application into the victim's browser context, enabling session hijacking or unauthorized content manipulation on behalf of higher-privileged users.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated, low-privileged attacker to inject and execute malicious JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM sources. Affected deployments span AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 through 6.5.24. The CVSS scope-change designation (S:C) indicates injected script can reach browser context beyond the AEM application boundary; no public exploit has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by directing them to a crafted URL, with scope change enabling cross-context impact beyond the AEM application itself. Affected deployments span AEM 6.5 LTS up to SP2, AEM 6.5 up to version 6.5.24, and AEM as a Cloud Service up to the 2026.7.0 release. No public exploit code or active exploitation has been confirmed at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to inject and execute malicious JavaScript in a victim's browser by luring them to a crafted webpage that manipulates the client-side DOM environment. Affected are AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), per Adobe advisory APSB26-98. The scope-change designation (S:C) indicates injected scripts can reach browser resources beyond AEM's own application boundary, enabling session theft or cross-origin actions. No public exploit or CISA KEV listing is present at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM processing. Affected versions include AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. Exploitation requires user interaction (victim must visit the crafted page), and the scope change in the CVSS vector (S:C) confirms the attack can affect resources beyond the immediate AEM application context. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript within a victim's browser session after tricking that user into visiting a crafted page. The vulnerability spans AEM as a Cloud Service (≤2026.7.0), AEM 6.5 on-premises (≤6.5.24), and AEM 6.5 LTS (≤SP2), covering all major supported deployment tracks. Adobe has released remediation via Security Bulletin APSB26-98; no confirmed active exploitation or public exploit code is recorded at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables a low-privileged attacker to inject and execute arbitrary JavaScript within a victim's browser session by manipulating the DOM environment through a crafted webpage. The vulnerability affects AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, with scope change indicating the malicious script can reach beyond AEM's own security context into the victim's broader browser environment. Adobe has addressed this in advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject malicious JavaScript that executes within a victim's browser session by manipulating the DOM environment client-side. Affecting AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, exploitation requires the victim to visit a specially crafted webpage, making social engineering a necessary step. Adobe has released APSB26-98 addressing all three product lines; no public exploit or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privileged attackers to execute arbitrary JavaScript within a victim's browser by inducing them to visit a specially crafted AEM webpage, with the scope crossing the AEM origin boundary into the browser's security context. All three supported deployment tracks are affected: AEM as a Cloud Service through the 2026.7.0 release cycle, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. Adobe addressed this under advisory APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL or page that manipulates the client-side DOM. Affected deployments span AEM 6.5 on-premises (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0), covering a broad range of enterprise CMS installations. The scope-changed CVSS vector (S:C) signals that the script executes beyond the AEM application context - enabling session hijacking, credential theft, or action-on-behalf-of attacks targeting higher-privilege users. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to deliver a crafted URL that, when visited by an authenticated victim, executes arbitrary JavaScript within the victim's browser context with scope change across security boundaries. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. Adobe has released APSB26-98 addressing this issue; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript that executes entirely within a victim's browser, bypassing server-side defenses. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed classification (S:C) indicates the injected script can operate beyond the AEM application boundary in the victim's browser context, enabling session hijacking or credential theft from a higher-privileged user. No confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript that executes within a victim's browser session by luring them to a crafted webpage. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, with scope changed - meaning injected scripts can affect resources beyond the immediate AEM origin. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor advisory APSB26-98 covers remediation.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged remote attacker to execute malicious JavaScript in a victim's browser by luring the victim to a crafted URL or page that manipulates the client-side DOM environment. Affected versions span the entire AEM 6.5 line through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. Adobe has addressed this through APSB26-98; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated low-privileged attackers to execute arbitrary JavaScript in victims' browsers by crafting pages that manipulate the DOM environment. Affected deployments include AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. The scope-changed CVSS vector signals that script execution can cross component or trust boundaries within the victim's browser session. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0 allows low-privileged authenticated attackers to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Exploitation requires the victim to visit a crafted webpage, placing this in a social-engineering or insider-threat scenario rather than direct network exploitation. The scope change (S:C) in the CVSS vector confirms the JavaScript executes outside AEM's security boundary in the victim's browser context. No public exploit or CISA KEV listing is identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute arbitrary JavaScript within a victim's browser session by manipulating the DOM environment via a crafted webpage. Affected deployments span AEM as a Cloud Service through July 2026, AEM 6.5 through version 6.5.24, and AEM 6.5 LTS through SP2. No public exploit or active exploitation has been identified at time of analysis; the CVSS score of 5.4 reflects the authentication prerequisite and mandatory victim interaction, though the scope-changed rating indicates the injected script can affect resources outside the AEM application boundary.
DOM-based cross-site scripting in Adobe Experience Manager allows authenticated users to execute malicious JavaScript within their browser context by visiting a crafted webpage. The vulnerability affects AEM as a Cloud Service (up to version 2026.7.0) and on-premises versions (6.5 up to 6.5.24, 6.5 LTS through SP2). With scope changed, the attack can extend beyond the vulnerable component to affect other AEM systems or data. No public exploit code or active exploitation confirmed at time of analysis.
DOM-based cross-site scripting in Adobe Experience Manager 6.5 releases through version 6.5.24 and Cloud Service deployments through 2026.7.0 allows authenticated attackers to execute malicious JavaScript in victims' browsers by injecting attacker-controlled DOM manipulation code into shared content. Successful exploitation harvests session tokens, performs unauthorized actions as the victim, and accesses sensitive data within the victim's authorized scope. The attack requires both attacker authentication and victim user interaction with crafted pages; no active exploitation or public exploits identified at analysis time.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM as a Cloud Service through 2026.7.0 and on-premises AEM 6.5 through 6.5.24 and LTS through SP2. Exploitation requires that a low-privileged attacker socially engineer a target user into visiting a specially crafted URL or page; vendor advisory APSB26-98 confirms the issue and provides patched releases. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute malicious JavaScript within a victim's browser session by manipulating client-side DOM data without server-side interaction. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope-changed nature of the flaw means successful exploitation can affect browser resources beyond the AEM application boundary; no public exploit code or active exploitation has been identified at time of analysis.
Stored XSS in Adobe Experience Manager allows authenticated low-privileged attackers to inject malicious JavaScript into vulnerable form fields that later executes in victims' browsers when they visit the affected page. Affected deployments span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). Adobe has addressed this in security bulletin APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged, network-accessible attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Scope change (S:C) confirms the attack crosses from the application server context into the victim's browser security context, enabling session hijacking, credential theft, or further phishing within the authenticated AEM environment. No public exploit or KEV listing is present at time of analysis; CVSS 5.4 (Medium) reflects the privilege and user-interaction barriers that limit opportunistic mass exploitation.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to persistently inject malicious JavaScript into vulnerable form fields within the CMS. When any victim - including administrators - browses to the page containing the injected payload, the script executes in their browser session under the AEM application's trust boundary, with scope changing to the victim's context. Affected versions span AEM 6.5 ≤6.5.24, AEM as a Cloud Service ≤2026.7.0, and AEM 6.5 LTS ≤SP2, with remediation available via Adobe advisory APSB26-98. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript within a victim's browser by inducing them to visit a crafted URL. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 on-premises (≤6.5.24), as confirmed by EUVD-2026-74147 and Adobe APSB26-98. The scope-change rating reflects that injected script runs in the victim's browser security context, enabling session theft, credential harvesting, or UI redress attacks against higher-privileged users. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows an authenticated low-privileged attacker to inject and execute arbitrary JavaScript within victim browsers by crafting a malicious URL that manipulates the client-side DOM environment. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed CVSS vector (S:C) indicates the injected script can reach resources beyond the AEM application's own security boundary. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment via a crafted webpage. Affected deployments span AEM 6.5 on-premises (≤6.5.24), AEM 6.5 LTS (≤SP2), and AEM as a Cloud Service (≤2026.7.0), as documented in Adobe APSB26-98. The CVSS S:C scope-change designation confirms the payload can escape the vulnerable component's security boundary, enabling session hijacking or cross-origin data exfiltration against privileged AEM users. No public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager 6.5 (through 6.5.24), 6.5 LTS (through SP2), and Cloud Service (through 2026.7.0) enables an authenticated attacker to inject malicious JavaScript that executes in a victim's browser by manipulating client-side DOM state. The scope change (S:C) in the CVSS vector reflects that the injected script runs within the AEM domain's browser context, potentially reaching session tokens, saved credentials, or authoring capabilities beyond the attacker's original privilege level. Exploitation requires the attacker to hold a valid low-privilege AEM account and to socially engineer a victim into visiting a crafted URL; no public exploit code has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL that manipulates the DOM environment. Affected across AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). The scope-changed CVSS vector confirms the script executes outside the originating security context, enabling session theft, credential harvesting, or actions-on-behalf-of-victim against the AEM interface. No public exploit code or CISA KEV listing identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating client-side DOM sinks via a crafted URL. Scope change (S:C) means the injected script executes outside AEM's own origin context, enabling session token theft or privilege escalation against higher-privileged AEM users. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, per Adobe advisory APSB26-98. No public exploit or active exploitation is identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables an authenticated low-privileged attacker to inject and execute malicious JavaScript in a victim's browser by tricking them into visiting a specially crafted URL. The vulnerability spans AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, covering a broad enterprise install base. The CVSS scope-change flag (S:C) is the most significant risk amplifier, indicating injected scripts can reach security contexts beyond the originating AEM application. No public exploit or CISA KEV listing exists at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker with low privileges to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Because scope is changed (S:C per CVSS), the injected script can reach browser resources beyond the AEM origin, enabling session token theft or unauthorized actions performed as the victim. No public exploit code has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged remote attacker to execute malicious JavaScript in a victim's browser by manipulating the DOM environment of a crafted webpage. Affected versions span AEM 6.5 through 6.5.24, AEM as a Cloud Service through the 2026.7.0 release, and AEM 6.5 LTS through SP2. No public exploit or active exploitation has been identified at time of analysis; Adobe has issued advisory APSB26-98 with patch availability.
Stored Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of users who visit the affected pages. Affected deployments include AEM 6.5 through version 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the scope-changed CVSS vector indicates meaningful session and interface impact when exploited.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) allows an authenticated attacker to inject malicious JavaScript into a victim's browser by manipulating the DOM environment through a crafted webpage. The vulnerability affects AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, and carries a scope change meaning injected scripts execute beyond the attacker's origin context. No public exploit identified at time of analysis, and it is not listed in the CISA KEV catalog.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by luring them to a crafted webpage. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and the Cloud Service through the 2026.7.0 release. Scope is changed per the CVSS vector, meaning the exploit crosses the boundary from the AEM application context into the broader browser environment; no public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privilege authenticated attackers to execute arbitrary JavaScript in victims' browsers by delivering crafted URLs or pages that manipulate the client-side DOM environment. All supported AEM deployment modes are affected: on-premises 6.5.x through 6.5.24, 6.5 LTS through SP2, and Cloud Service through 2026.7.0. Adobe addressed this in security bulletin APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When a higher-privileged user (such as an administrator) browses the affected page, the script executes in their browser context, enabling session hijacking, credential theft, or UI redirection. The scope change (S:C in CVSS) signals that injected scripts can operate outside the application's own origin, amplifying the effective impact beyond the application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted webpage. The vulnerability spans Adobe Experience Manager as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), per APSB26-98. No active exploitation or public exploit code has been identified at time of analysis, though the scope-changed nature means successful exploitation can cross security boundaries within the victim's browser context.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated, low-privileged attacker to inject and execute arbitrary JavaScript in the browser session of any victim who visits a crafted AEM page. Affected are AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 on-premise through 6.5.24. The scope-changed CVSS rating (S:C) reflects that the injected script executes in the victim's browser context and can reach resources-such as session tokens and authenticated API calls-beyond the originating AEM page, amplifying the practical impact relative to the medium base score.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute malicious JavaScript within a victim's browser by delivering a crafted URL or page that manipulates the client-side DOM. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope change in the CVSS vector reflects that injected script executes beyond the originating component boundary, potentially enabling session theft or privilege escalation against higher-privileged AEM users. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) allows an authenticated attacker to execute arbitrary JavaScript within a victim's browser by enticing them to visit a crafted URL, affecting AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the July 2026 release. The CVSS scope change (S:C) signals that the injected script escapes AEM's own browser origin boundary, enabling session hijacking or unauthorized CMS operations under the victim's identity. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the broad enterprise footprint of AEM makes patching a priority.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user - including higher-privileged administrators - browses to the page containing the injected payload, the script executes in their browser context, crossing scope boundaries into the victim's session. Affected versions span AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2, as confirmed by APSB26-98. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser that subsequently visits the affected page. The scope-changed nature of this flaw (S:C in CVSS) means the attacker's script runs within the victim's browser security context, enabling session token theft, credential harvesting, or further client-side attacks. Affected deployments span AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2; no public exploit code or KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields within the CMS. When any user-including administrators-browses to a page containing the injected content, the script executes in their browser under a changed security context (S:C), enabling session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. Affected versions span AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2; no public exploit or active exploitation confirmed via CISA KEV at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields within the authoring environment. When any higher-privileged user subsequently browses the affected page, the script executes in their browser within a changed scope, potentially enabling session theft or unauthorized actions. Adobe has issued advisory APSB26-98 covering AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0; no public exploit or CISA KEV listing has been identified.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to persist malicious JavaScript payloads in vulnerable form fields, which then execute in any victim's browser upon page visit. Affected versions span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). Adobe has addressed the issue in security bulletin APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
Stored XSS in Adobe Experience Manager permits low-privileged authenticated users to inject persistent JavaScript payloads into vulnerable form fields within the CMS authoring interface. When any user - including administrators - browses a page containing the injected field, their browser executes the attacker's script in the context of the AEM domain, with scope change confirming cross-boundary impact. All AEM 6.5 versions through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 build are affected; remediation is available via Adobe APSB26-98. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of other users - including administrators - when they visit the affected page. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit or CISA KEV listing has been identified at time of analysis; the scope-changed CVSS vector reflects the cross-user browser impact.
Stored XSS in Adobe Experience Manager allows low-privileged authenticated attackers to inject malicious JavaScript into vulnerable form fields, where it persists server-side and executes in any victim's browser upon visiting the affected page. Three release tracks are affected: AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. The scope-changed impact means attacker-controlled scripts run in victim browser contexts - including those of administrators - enabling session hijacking, credential theft, or unauthorized actions on behalf of higher-privileged users. No public exploit or CISA KEV listing identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser when they navigate to the affected page. Affected deployments span AEM 6.5 through 6.5.24 and 6.5 LTS through SP2 (on-premises), as well as AEM as a Cloud Service through the July 2026 release (2026.7.0). Adobe has published advisory APSB26-98 confirming the scope-changed impact; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields that persists and executes in the browsers of other users who visit the affected page. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed nature of the vulnerability means the attacker's payload crosses from the AEM application context into victim browser sessions, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to manipulate client-side DOM processing and execute arbitrary JavaScript in a victim's browser session. Affected deployments span AEM 6.5 up to version 6.5.24, AEM 6.5 LTS up to SP2, and AEM as a Cloud Service up to release 2026.7.0. Exploitation requires convincing an authenticated victim to visit a specially crafted URL; scope is changed because the injected script runs in the victim's browser context outside the AEM application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis; Adobe has issued patches under advisory APSB26-98.
Path traversal in Adobe Photoshop Mobile for Android (≤1.6.0.2294 and ≤1.6.0.2299) enables a low-privileged attacker to cause a security feature bypass, reading unauthorized files or directories outside the app's intended sandbox and producing high availability impact when a victim opens a maliciously crafted Photoshop document. The CVSS 3.1 score of 5.0 captures the meaningful constraints: local attack vector, high complexity, required user interaction, and the fact that exploitation depends on conditions beyond the attacker's control. No active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis.
Out-of-bounds read in Adobe DNG SDK 1.7.1 2502 and earlier exposes sensitive memory contents when a victim opens a maliciously crafted DNG file. The flaw resides in the SDK's file parser and affects any application built on top of the DNG SDK that processes untrusted DNG inputs. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, limiting current urgency despite the High confidentiality impact.
Out-of-bounds write in Adobe DNG Software Development Kit versions 1.7.1 2502 and earlier allows memory corruption when a victim opens a maliciously crafted DNG file, causing the consuming application to crash or become unresponsive. The flaw (CWE-787) is constrained to a local, user-interaction-dependent attack path, limiting automated exploitation. No public exploit code has been identified at time of analysis and no CISA KEV listing exists.
Out-of-bounds read in Adobe Substance 3D Painter exposes sensitive process memory when a victim opens a specially crafted malicious file. The flaw, classified as CWE-125, causes the application to read beyond allocated buffer boundaries during file parsing, potentially leaking in-memory data such as credentials or session tokens accessible to the attacker. Adobe has published security advisory APSB26-129 addressing the issue; no public exploit code has been identified at time of analysis.
Out-of-bounds read in Adobe Illustrator Desktop 2025 and 2026 exposes sensitive process memory to disclosure when a victim opens a specially crafted file. The vulnerability carries a CVSS 3.1 score of 5.5 (Medium) with a local attack vector and required user interaction, limiting opportunistic exploitation but making it viable in targeted social-engineering campaigns. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Substance3D - Designer crashes on availability when a victim opens a specially crafted malicious file, triggering a NULL Pointer Dereference that terminates the application. Adobe Substance 3D Designer users across all tracked versions (CPE wildcard) are affected, with impact limited to application-level denial of service - no code execution, data disclosure, or integrity compromise is possible. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, consistent with its low exploitability ceiling (requires local victim interaction).
Integer underflow in Adobe's Content Credentials Rust SDK and c2pa_tool allows a local attacker to crash the application via a crafted C2PA manifest, causing a denial-of-service condition. Both the standalone CLI tool (c2pa_tool) and the Rust SDK library (content_credentials_rust_sdk) are affected per CPE data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the absence of user interaction requirement lowers the bar for automated or scripted triggering.
Integer underflow (CWE-191) in Adobe's Content Credentials Rust SDK and C2PA Tool crashes the application when processing a specially crafted C2PA manifest, producing a denial-of-service condition. Both the c2pa_tool and content_credentials_rust_sdk components are confirmed affected per Adobe advisory APSB26-110. No public exploit code or active exploitation has been identified; impact is limited entirely to application availability with no confidentiality or integrity consequences.
Arbitrary file system read in Adobe's Content Credentials (C2PA Tool and Content Credentials Rust SDK) exposes sensitive files and directories outside the intended access scope through improper input validation during file parsing. The attack requires a victim to open a malicious file crafted by the attacker, making this a local, user-interaction-dependent vulnerability with high confidentiality impact but no integrity or availability consequence. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis.
Path traversal in dekdee's adobe-xd-mcp 1.0.0 exposes the server filesystem to remote unauthenticated attackers via unsanitized `outputFile` and `outputDir` parameters in the `file-access-from-request` endpoint of `src/parsers/xd-parser.ts`. A public proof-of-concept exploit is available through the project's GitHub issue tracker, and no patch has been released - the vendor has not responded to the disclosure. With a CVSS 4.0 score of 6.9, public exploit code (E:P), and no mitigating authentication requirement, any network-exposed instance is immediately at risk.
Privilege escalation in Adobe Commerce and Magento Open Source exposes restricted resources to authenticated high-privilege users through a flawed authorization check (CWE-863). Affected products span the full 2.4.x series of Adobe Commerce and Magento Open Source, plus the 1.3.x-1.5.x Adobe Commerce B2B extension. No public exploits are known, CISA SSVC rates exploitation as none, and vendor-released August 2026 patches are available across all affected release lines per advisory APSB26-92.
Incorrect Authorization in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B allows a network-accessible, high-privileged attacker to bypass platform security controls and gain unauthorized write access, resulting in high integrity and availability impacts. Affected are Adobe Commerce through 2.4.9-2026-jul, Magento Open Source through 2.4.9-2026-jul, and Adobe Commerce B2B through 1.5.3-2026-jul, with August 2026 patches available per Adobe APSB26-92. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Improper input validation in Adobe's Content Credentials ecosystem (Rust SDK, JS SDK, and CLI tool) allows local attackers to bypass C2PA content authenticity security controls and gain unauthorized limited write access to credential metadata. Affected are c2pa-v0.90.5 and earlier, @contentauth/c2pa-web@0.12.0 and earlier, and c2patool-v0.27.5 and earlier. No user interaction is required, but the local attack vector (AV:L) and SSVC automation rating of 'no' constrain realistic exploitation to targeted scenarios rather than mass exploitation.
Integer underflow (CWE-191) in Adobe's Content Credentials ecosystem - covering the Rust SDK (c2pa), JavaScript SDK (@contentauth/c2pa-web), and CLI tool (c2patool) - allows a local attacker to crash any application that processes a specially crafted content credential payload, producing a denial-of-service condition. All three components share the underlying parsing logic and are affected up to their respective patch releases. No public exploit or CISA KEV listing has been identified at time of analysis, but the availability of patched versions and a vendor advisory (APSB26-111) confirms vendor-acknowledged impact.
Path traversal in Adobe's CAI Content Credentials ecosystem - spanning the Rust SDK (c2pa-v0.90.5 and earlier), the JavaScript/Web SDK (@contentauth/c2pa-web@0.12.0 and earlier), and the c2patool command-line utility (v0.27.5 and earlier) - enables arbitrary file system reads outside the intended access scope. The flaw is triggered when a victim processes a maliciously crafted file or visits a compromised web page that causes the SDK to resolve attacker-controlled path sequences. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; patched releases exist for all three components.
Integer overflow in Adobe's CAI Content Credentials SDK family (Rust, JavaScript, and CLI) allows a local attacker to crash the application, producing a denial-of-service condition. All three components - the Rust c2pa crate, the JS c2pa-web package, and the c2patool command-line utility - share the same CWE-190 root cause and are affected up to their respective boundary versions. No public exploit code or active exploitation has been identified; Adobe has released patched versions for all three components per advisory APSB26-111.
Integer overflow in Adobe's Content Credentials ecosystem - spanning the Rust SDK (c2pa ≤ v0.90.5), JavaScript SDK (@contentauth/c2pa-web ≤ 0.12.0), and the c2patool CLI (≤ v0.27.5) - allows denial-of-service through application crash when processing maliciously crafted C2PA assets. The CVSS:3.1/AV:L vector indicates the exploitable surface is file or data ingestion rather than a directly exposed network service, requiring no user interaction or privileges once a crafted asset reaches the parsing pipeline. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Uncontrolled resource consumption in Adobe's CAI Content Credentials ecosystem (c2patool CLI, Rust SDK, and JS SDK) allows a local attacker to trigger application denial-of-service by supplying crafted input that exhausts system resources. Three distinct release artifacts are affected: the c2patool command-line utility, the c2pa Rust crate, and the @contentauth/c2pa-web JavaScript SDK, all patched in a coordinated Adobe PSIRT disclosure (APSB26-111). No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as 'none' with non-automatable attack conditions.
Certificate validation bypass in Adobe's Content Credentials SDK undermines the C2PA provenance chain across three SDK variants - JavaScript/WASM (@contentauth/c2pa-web through 0.12.0), Rust (c2pa through v0.90.5), and CLI (c2patool through v0.27.5) - allowing an attacker-controlled certificate to be accepted as legitimate when a victim visits a malicious URL or interacts with a compromised web page. Successful exploitation grants unauthorized write access to content credentials, enabling an attacker to forge provenance metadata and defeat the product's core integrity guarantee. No public exploit has been identified at time of analysis; vendor-released patches exist for all three affected SDK variants.
Improper input validation across Adobe's Content Credentials JS SDK, Rust SDK, and command-line tool allows a remote unauthenticated attacker to bypass integrity verification and gain unauthorized write access to C2PA-signed content metadata. All three SDK components prior to their respective patch releases are affected, and exploitation requires a victim to visit a maliciously crafted URL or interact with a compromised web page. No public exploit code or active exploitation has been identified at time of analysis, though the write-impact on content authenticity signals carries meaningful trust implications for downstream consumers.
Integer underflow in Adobe's Content Credentials SDK crashes any application that parses a specially crafted C2PA manifest file, producing a denial-of-service condition. The Rust crate (c2pa ≤0.90.5), JavaScript/WASM package (@contentauth/c2pa-web ≤0.12.0), and CLI tool (c2patool ≤0.27.5) are all affected, with patched releases confirmed by Adobe advisory APSB26-111. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact is highest in automated media ingestion pipelines that validate C2PA provenance on user-supplied files.
Uncontrolled resource consumption in Adobe's Content Credentials ecosystem - spanning the c2patool CLI (≤v0.27.5), Rust SDK c2pa (≤v0.90.5), and JavaScript SDK @contentauth/c2pa-web (≤v0.12.0) - allows a local attacker without elevated privileges to exhaust system resources and cause an application denial-of-service. The vulnerability does not require user interaction, lowering the bar for exploitation in automated pipelines. Adobe has released patches across all three components via advisory APSB26-111, and no public exploit code or active exploitation has been identified at time of analysis.
Integer overflow in Adobe's Content Credentials SDK and CLI toolchain crashes the application when processing crafted input, resulting in a denial-of-service condition. Affected components span the Rust SDK (c2pa), the command-line tool (c2patool), and the JavaScript/WebAssembly SDK (@contentauth/c2pa-web), all at versions prior to their respective patch releases. No public exploit has been identified at time of analysis, and SSVC assesses exploitation as none with non-automatable delivery.
SSRF with privilege escalation affects Adobe's Content Credentials SDK and CLI toolchain, enabling a network-based attacker to induce the victim's client to issue server-side requests to unintended internal or external targets. Exploitation requires user interaction - a victim must visit a crafted URL or engage with a compromised web page - but the CVSS scope change (S:C) indicates the vulnerability can reach beyond the directly vulnerable component to affect other systems or services. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Improper input validation in Adobe ColdFusion 2023 and 2025 allows a remote attacker holding high-privileged credentials to crash the application server via a crafted network request, producing a denial-of-service condition. Affected versions are ColdFusion 2023 ≤ 2023.0.22 and ColdFusion 2025 ≤ 2025.0.11, with vendor-released patches documented in Adobe Security Bulletin APSB26-90. No public exploit code or confirmed active exploitation has been identified at time of analysis.
ColdFusion 2023 and 2025 contain an Incorrect Authorization flaw (CWE-863) that allows any low-privileged authenticated user to remotely crash the application server, producing a denial-of-service condition. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation requires only network access and a valid low-privilege credential with no interaction from other users, making repeated service disruption trivial for any credentialed attacker. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored XSS in Adobe ColdFusion 2023 (≤2023.0.22) and 2025 (≤2025.0.11) allows a low-privileged attacker to persist malicious JavaScript in vulnerable form fields, which then executes in the browsers of other users who view the affected page. The CVSS scope change (S:C) reflects that injected scripts can impact users beyond the attacker's own session - including potentially higher-privileged administrators. No public exploit code exists and CISA has not listed this in KEV; SSVC rates exploitation as none and technical impact as partial at time of analysis.
ColdFusion 2023 and ColdFusion 2025 contain an improper output encoding flaw (CWE-116) enabling low-privileged network attackers to circumvent security controls, achieve limited unauthorized write access, and cause modest availability disruption. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack is network-reachable, requires only a low-privileged account, and needs no user interaction. No public exploit code has been identified and CISA SSVC assigns exploitation status of none; vendor-released patches are available as ColdFusion 2023 update 2023.0.23 and ColdFusion 2025 update 2025.0.12 per Adobe advisory APSB26-90.
SAP NetWeaver AS Java's Adobe Document Services (ADS) component ships outdated open-source cryptographic and data transfer libraries that carry known, unpatched-within-the-product vulnerabilities classified under CWE-1395. Low-privileged authenticated attackers with network access can exploit these library weaknesses to achieve limited impact across confidentiality, integrity, and availability of the affected ADS component. No public exploit code or active exploitation has been identified; this is a supply-chain dependency risk with a CVSS 6.3 Medium score and no indication of weaponization at time of analysis.
Adobe Genuine Software Integrity Service on local systems exposes an Incorrect Authorization flaw (CWE-863) enabling any local attacker - without elevated privileges - to bypass the service's integrity-verification controls and obtain unauthorized limited write access to areas the service is designed to protect. All tracked versions of the service are affected per the open-ended CPE range published by Adobe. No public exploit or CISA KEV listing has been identified at time of analysis, and exploitation is constrained to the local environment, reducing mass-exploitation risk while remaining a realistic threat from malware, shared-account misuse, or low-privileged insider scenarios.
Uncontrolled resource consumption in Adobe's C2PA Content Credentials Rust SDK, CLI tool (c2patool), and JavaScript web SDK allows a local attacker supplying a crafted input to exhaust system resources and crash the application. All three library families are affected across distinct runtimes - Rust, Node.js, and native binary - with patched releases available for each. No public exploit exists, SSVC classifies exploitation as none, and EPSS sits at the 5th percentile, indicating low real-world exploitation pressure despite the zero-user-interaction requirement.
Integer overflow in Adobe's Content Credentials SDK family (c2pa Rust SDK, c2pa-web JS SDK, and c2patool CLI) allows a local attacker to crash any application that processes a specially crafted C2PA manifest, resulting in denial of service. All three components share the vulnerable parsing logic and are affected across versions up to c2pa-v0.84.0, @contentauth/c2pa-web@0.7.0, and c2patool-v0.16.5 respectively. No public exploit exists and SSVC confirms no observed exploitation; however, patches are available and should be applied given the zero-privilege-required local trigger condition.