Experience Manager
Monthly
Privilege escalation to arbitrary code execution in Adobe Experience Manager (AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2) lets a low-privileged authenticated attacker abuse an incorrect-authorization flaw to execute code and take over a victim's account or session without any user interaction. Because the CVSS scope is changed, the impact extends beyond the vulnerable component. Adobe (PSIRT) rated it 9.9 critical and shipped a fix in APSB26-98; no public exploit is identified at time of analysis.
Sitecore Experience Manager/Platform through version 9.0 contains a deserialization vulnerability enabling code injection through untrusted data processing.
Sitecore PowerShell Extensions through version 7.0 allows authenticated users to upload arbitrary files including ASPX webshells via crafted HTTP requests. The unrestricted file upload bypasses content type restrictions, enabling remote code execution on the Sitecore IIS server with any authenticated account.
Sitecore Experience Manager, Platform, and Commerce versions 9.0 through 10.4 contain a Zip Slip vulnerability that allows authenticated attackers to write arbitrary files outside the intended upload directory. By crafting ZIP archives with path traversal entries, attackers can overwrite application files and achieve remote code execution.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to permanently inject malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Affected deployments include AEM 6.5 LTS up to SP2, AEM 6.5 up to 6.5.24, and AEM as a Cloud Service up to 2026.7.0, per Adobe advisory APSB26-98. No public exploit or active exploitation has been identified at time of analysis, though the low-complexity attack path and broad AEM deployment make this a meaningful persistent threat in content-rich enterprise environments.
Stored Cross-Site Scripting in Adobe Experience Manager 6.5 LTS (≤SP2), AEM 6.5 (≤6.5.24), and AEM as a Cloud Service (≤2026.7.0) allows a low-privileged authenticated attacker to persist malicious JavaScript in vulnerable form fields of the authoring interface. When any other authenticated user visits the page containing the injected payload, the script executes in their browser under the site's origin with a changed scope, enabling session token theft or unauthorized actions on the victim's behalf. No public exploit code or active exploitation is identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who visits the affected page. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has released patches under advisory APSB26-98; no public exploit or CISA KEV listing is identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious scripts into vulnerable form fields. When any user - including administrators - subsequently browses the affected page, the injected JavaScript executes in their browser context, enabling session hijacking, credential theft, or UI redress attacks. Affected versions span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user-including administrators-browses a page containing the injected content, the script executes in their browser, enabling session hijacking, credential theft, or unauthorized actions under the victim's identity. The scope-changed CVSS vector confirms the attack crosses security boundaries, affecting users beyond the injecting account. No public exploit code and no CISA KEV listing are present at time of analysis.
Stored cross-site scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes silently in any victim's browser upon page load. The vulnerability spans AEM 6.5 up to 6.5.24, AEM 6.5 LTS up to SP2, and AEM as a Cloud Service up to build 2026.7.0, per Adobe security bulletin APSB26-98. Because the scope changes to the victim's browser context, a successful injection enables session token theft, credential harvesting, or further client-side attacks against any user - including administrators - who visits the poisoned content.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser when they navigate to the affected page. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through the 2026.7.0 release. The CVSS scope-change flag (S:C) signals that injected scripts escape the AEM application trust boundary and execute in the victim browser's security context; no public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields across the authoring interface. When any victim - including higher-privileged users such as administrators - browses to the page rendering the stored payload, the script executes in their browser, enabling session token theft, unauthorized content manipulation, or further actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis; Adobe has released fixes via security advisory APSB26-98.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which executes in any victim's browser that subsequently navigates to the affected page. The scope-changed CVSS vector (S:C) confirms that injected scripts operate within the victim's browser security context, enabling session hijacking, credential theft, or unauthorized AEM actions against higher-privileged users. Adobe has issued advisory APSB26-98 covering AEM as a Cloud Service, AEM 6.5, and AEM 6.5 LTS; no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Affected versions span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0), as documented in Adobe advisory APSB26-98. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser that renders the affected page. The vulnerability affects AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit code or active exploitation has been identified at time of analysis, and Adobe has addressed this in advisory APSB26-98.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any victim user browses to the affected page, the script executes in their browser within a changed scope context - enabling session theft, credential harvesting, or UI redressing against higher-privileged users. No public exploit code and no CISA KEV listing at time of analysis, but the low complexity and network accessibility make this straightforward to exploit by any authenticated user with form-submission rights.
Stored XSS in Adobe Experience Manager enables a low-privileged authenticated attacker to persistently inject malicious JavaScript into vulnerable form fields within the content authoring interface. When any user - including privileged editors or administrators - navigates to the affected page, the injected script executes in their browser session, potentially enabling session hijacking, credential theft, or unauthorized actions on their behalf. Adobe addressed this under advisory APSB26-98; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields. When any user-including administrators-visits the page containing the injected content, the script executes in their browser under a changed scope (S:C), enabling session theft, credential harvesting, or unauthorized actions on behalf of the victim. Affected are AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. No public exploit or active exploitation is identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields. When any user - including administrators - browses to pages containing the poisoned fields, the injected script executes in their browser under the AEM origin, enabling session token theft, credential harvesting, or UI redirection. Three deployment lines are affected: AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. No public exploit code or active exploitation has been identified at time of analysis.
Improper input validation in Adobe Experience Manager allows a low-privileged remote attacker to bypass a security feature and gain unauthorized limited write access to the platform. Affected deployments span AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 through 6.5.24. Exploitation requires social engineering - a logged-in victim must visit a crafted URL or interact with a compromised web page - constraining real-world reach. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables authenticated low-privilege attackers to inject and execute arbitrary JavaScript within a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope-changed CVSS vector indicates successful exploitation can cross session boundaries, enabling session token theft or unauthorized actions beyond the attacker's direct privilege level - though exploitation requires both a valid AEM credential and victim interaction via a crafted page. No public exploit code and no CISA KEV listing exist at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables authenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM sinks without sanitization. Affected releases span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe addressed this in security bulletin APSB26-98; no confirmed active exploitation or public proof-of-concept code has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated low-privilege attackers to execute arbitrary JavaScript in the browser context of targeted users who visit a crafted webpage. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through the 2026.7.0 release. Adobe addressed this in advisory APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by manipulating the DOM environment through a crafted webpage. Affected versions span AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 through 6.5.24. No public exploit code or active exploitation has been identified at time of analysis; vendor patch is documented under Adobe APSB26-98.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to inject malicious JavaScript that executes within a victim's browser context, with scope changing beyond AEM's own origin. Three product lines are affected: AEM 6.5, AEM 6.5 LTS, and AEM as a Cloud Service through their respective latest releases at time of disclosure. Exploitation requires user interaction - the victim must navigate to an attacker-crafted URL while authenticated - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM sinks. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), per Adobe advisory APSB26-98. The scope-changed CVSS vector indicates impact can extend beyond the AEM application boundary into the victim's broader browser session; no public exploit has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment via a crafted URL or webpage. All three AEM delivery models are affected - on-premises 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has published Security Bulletin APSB26-98 addressing this issue; no public exploit code and no CISA KEV listing have been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to execute arbitrary JavaScript within a victim's browser by enticing them to visit a crafted URL. All currently supported AEM deployment models are affected - Cloud Service through 2026.7.0, on-premises 6.5 through 6.5.24, and 6.5 LTS through SP2. The scope change in the CVSS vector indicates the JavaScript executes in a context beyond the vulnerable component itself, potentially enabling session hijacking or privilege escalation within the AEM environment. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
DOM-based XSS in Adobe Experience Manager enables an authenticated attacker to inject malicious JavaScript that executes within a victim's browser by manipulating client-side DOM sinks on crafted or attacker-influenced AEM pages. Affected deployments span AEM 6.5 on-premises through version 6.5.24, the 6.5 LTS track through SP2, and AEM as a Cloud Service through the 2026.7.0 release channel. Adobe has addressed the issue in advisory APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a network-adjacent, low-privileged attacker to execute arbitrary JavaScript within a victim's browser session by luring them to a crafted webpage. The vulnerability arises from unsanitized attacker-controlled data being written into the DOM without server-side involvement, enabling script execution in a changed security scope (S:C). Exploitation requires user interaction and no public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) enables an authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating client-side DOM sources and sinks via a crafted webpage. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 (≤6.5.24), and AEM 6.5 LTS (≤SP2), as confirmed by Adobe APSB26-98. The CVSS scope-change metric (S:C) indicates the payload escapes the AEM application context and can affect the victim's broader browser environment; no public exploit identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated, low-privileged attacker to execute arbitrary JavaScript in a victim's browser session by inducing that authenticated user to visit a crafted webpage. Affected versions span AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. The CVSS scope-change indicator (S:C) reflects that injected scripts execute within the victim's browser context, potentially enabling session theft, credential harvesting, or actions performed on behalf of the victim beyond the AEM application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to execute arbitrary JavaScript in a victim's browser by luring the victim to a crafted webpage. Affected are AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope-changed impact means the malicious script executes outside the originating application boundary, enabling session hijacking, credential theft, or UI redressing against authenticated AEM users. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary JavaScript within a victim's browser session by delivering a crafted URL that manipulates the client-side DOM environment. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The CVSS scope change (S:C) indicates the injected script executes in a different browser security context than the attacker's origin, enabling cross-context session abuse. No public exploit or CISA KEV listing is present at time of analysis.
DOM-based XSS in Adobe Experience Manager allows authenticated low-privileged attackers to inject malicious JavaScript into a victim's browser by luring them to a specially crafted URL that manipulates the client-side DOM without server-side involvement. Affected versions include AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has issued a fix under advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to inject and execute arbitrary JavaScript within a victim's browser by enticing them to visit a crafted URL or page, with scope change enabling cross-context impact. Affected versions include AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0, all addressed under Adobe Security Bulletin APSB26-98. No public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to inject malicious JavaScript into a victim's browser by manipulating the DOM environment through a crafted webpage. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit has been identified at time of analysis; Adobe has published security bulletin APSB26-98 addressing this issue.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to execute arbitrary JavaScript in a victim's browser by delivering a specially crafted URL or page that exploits client-side DOM processing. Affected are AEM 6.5 LTS through SP2, AEM 6.5 on-premise through 6.5.24, and AEM as a Cloud Service through the 2026.7.0 release. Successful exploitation enables session hijacking, credential theft, or unauthorized actions performed within the AEM environment on behalf of the victim, with scope change indicating impact crosses from the web application into the victim's browser context.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted webpage that manipulates the client-side DOM environment. The scope-changed CVSS vector (S:C) confirms the malicious script executes in the victim's browser security context rather than the server, enabling session hijacking, credential theft, or UI redress against AEM users. Reported directly by Adobe PSIRT and addressed in advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to manipulate client-side DOM variables to inject and execute arbitrary JavaScript within a victim's browser session. Affected are AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, per Adobe advisory APSB26-98. The scope change in the CVSS vector indicates that injected scripts can reach browser resources outside the AEM application origin, enabling session hijacking or cross-application data theft when a victim clicks a crafted link.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a network-accessible, low-privileged attacker to inject malicious JavaScript that executes entirely within a victim's browser session by manipulating the DOM environment. Affected versions span the AEM 6.5 branch (≤6.5.24), the 6.5 LTS edition (≤SP2), and AEM as a Cloud Service (≤2026.7.0), covering a broad enterprise install base. The CVSS vector confirms a scope change (S:C), meaning successful exploitation can affect browser resources beyond the originating AEM page - such as session tokens or cross-frame content - though user interaction via a crafted webpage visit is required for the attack to succeed.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) enables authenticated attackers with low-level access to inject malicious JavaScript into victim browsers, achieving a scope change that allows cross-origin script execution. Affected versions span AEM as a Cloud Service ≤2026.7.0, AEM 6.5 LTS ≤SP2, and AEM 6.5 ≤6.5.24, as confirmed by Adobe advisory APSB26-98. Exploitation requires user interaction; no public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject malicious JavaScript that executes inside a victim's browser when the victim visits a specially crafted URL or page hosted within the AEM environment. Affects AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. No public exploit identified at time of analysis; Adobe has released patches via advisory APSB26-98.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by directing the victim to a crafted webpage that manipulates the AEM client-side DOM environment. Affected releases span AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. The scope-changed impact means the injected script operates outside AEM's own origin boundary, enabling session theft or unauthorized actions against the authenticated victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) allows a low-privileged attacker to execute arbitrary JavaScript within a victim's browser by luring them to a crafted webpage that manipulates the client-side DOM environment. Affected versions span AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. The vulnerability carries a scope-change flag (S:C), indicating the injected script can affect browser context beyond AEM's own page, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating the DOM environment through a crafted webpage. Affected are AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit or KEV listing has been identified at time of analysis; exploitation requires both attacker authentication (PR:L) and victim interaction with a crafted URL or page.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript within a victim's browser by enticing them to visit a specially crafted URL. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the July 2026 (2026.7.0) release, with Adobe addressing this in security bulletin APSB26-98. The CVSS scope-change metric (S:C) reflects that successful exploitation crosses the AEM application boundary into the victim's browser context, enabling session hijacking, credential theft, or forced authenticated actions - no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject and execute arbitrary JavaScript in victims' browsers after social-engineering them into visiting a crafted webpage. Affected versions span AEM as a Cloud Service up to 2026.7.0, AEM 6.5 up to 6.5.24, and AEM 6.5 LTS up to SP2. The CVSS scope-change indicator (S:C) means injected scripts can reach browser contexts beyond the AEM origin, elevating potential impact to cross-origin session theft or privilege escalation within the CMS authoring environment. No public exploit or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2 enables authenticated low-privileged attackers to inject and execute arbitrary JavaScript in a victim's browser by manipulating the Document Object Model client-side. The scope change (S:C in the CVSS vector) confirms that successful exploitation escapes AEM's own security boundary, allowing the injected script to access browser-resident resources such as cookies, localStorage, or cross-origin-accessible DOM of other open pages. Exploitation requires a victim with a valid AEM session to be social-engineered into visiting a crafted URL, making this a realistic privilege-escalation vector from author/editor to administrator in enterprise AEM deployments. No public exploit code or CISA KEV listing identified at time of analysis; vendor advisory APSB26-98 is available.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated remote attackers to execute arbitrary JavaScript in a victim's browser by manipulating the DOM environment of a crafted webpage the victim is induced to visit. Affected deployments span AEM 6.5 on-premises through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has released a remediation via advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute arbitrary JavaScript within a victim's browser session by manipulating the client-side DOM environment. Affected versions span the AEM 6.5 branch (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). Exploitation requires the attacker to hold a low-privileged AEM account and socially engineer a target user into visiting a crafted URL; no public exploit or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by manipulating the client-side DOM environment, achieving a scope change that can affect resources beyond the AEM origin. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), covering both cloud and on-premises enterprise installations. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires a victim to interact with a crafted webpage delivered by the attacker.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript in a victim's browser by inducing them to visit a crafted URL that manipulates client-side DOM sinks. Affected deployments span AEM 6.5 on-premises through version 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The CVSS scope-change (S:C) indicates injected scripts execute outside the vulnerable component's security boundary, enabling session theft or privileged action execution within the AEM browser origin. No public exploit or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript in a victim's browser session by luring the victim to a crafted URL or webpage. Affected deployments span Adobe Experience Manager 6.5 (through 6.5.24), Experience Manager 6.5 LTS (through SP2), and the Experience Manager as a Cloud Service (through the 2026.7.0 release). The scope-change designation confirms the malicious script executes outside the AEM server context - in the victim's browser - enabling session token theft, credential harvesting, or unauthorized AEM actions on behalf of the victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) enables a low-privileged authenticated attacker to inject malicious JavaScript into a victim's browser by manipulating client-side DOM sources before they reach execution sinks. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release; Adobe has addressed this through security advisory APSB26-98. The CVSS scope-change flag (S:C) reflects that successful exploitation crosses the boundary from the vulnerable AEM application into the victim's browser context, enabling session hijacking or unauthorized content manipulation on behalf of higher-privileged users.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated, low-privileged attacker to inject and execute malicious JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM sources. Affected deployments span AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 through 6.5.24. The CVSS scope-change designation (S:C) indicates injected script can reach browser context beyond the AEM application boundary; no public exploit has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by directing them to a crafted URL, with scope change enabling cross-context impact beyond the AEM application itself. Affected deployments span AEM 6.5 LTS up to SP2, AEM 6.5 up to version 6.5.24, and AEM as a Cloud Service up to the 2026.7.0 release. No public exploit code or active exploitation has been confirmed at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to inject and execute malicious JavaScript in a victim's browser by luring them to a crafted webpage that manipulates the client-side DOM environment. Affected are AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), per Adobe advisory APSB26-98. The scope-change designation (S:C) indicates injected scripts can reach browser resources beyond AEM's own application boundary, enabling session theft or cross-origin actions. No public exploit or CISA KEV listing is present at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM processing. Affected versions include AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. Exploitation requires user interaction (victim must visit the crafted page), and the scope change in the CVSS vector (S:C) confirms the attack can affect resources beyond the immediate AEM application context. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript within a victim's browser session after tricking that user into visiting a crafted page. The vulnerability spans AEM as a Cloud Service (≤2026.7.0), AEM 6.5 on-premises (≤6.5.24), and AEM 6.5 LTS (≤SP2), covering all major supported deployment tracks. Adobe has released remediation via Security Bulletin APSB26-98; no confirmed active exploitation or public exploit code is recorded at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables a low-privileged attacker to inject and execute arbitrary JavaScript within a victim's browser session by manipulating the DOM environment through a crafted webpage. The vulnerability affects AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, with scope change indicating the malicious script can reach beyond AEM's own security context into the victim's broader browser environment. Adobe has addressed this in advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject malicious JavaScript that executes within a victim's browser session by manipulating the DOM environment client-side. Affecting AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, exploitation requires the victim to visit a specially crafted webpage, making social engineering a necessary step. Adobe has released APSB26-98 addressing all three product lines; no public exploit or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privileged attackers to execute arbitrary JavaScript within a victim's browser by inducing them to visit a specially crafted AEM webpage, with the scope crossing the AEM origin boundary into the browser's security context. All three supported deployment tracks are affected: AEM as a Cloud Service through the 2026.7.0 release cycle, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. Adobe addressed this under advisory APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL or page that manipulates the client-side DOM. Affected deployments span AEM 6.5 on-premises (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0), covering a broad range of enterprise CMS installations. The scope-changed CVSS vector (S:C) signals that the script executes beyond the AEM application context - enabling session hijacking, credential theft, or action-on-behalf-of attacks targeting higher-privilege users. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to deliver a crafted URL that, when visited by an authenticated victim, executes arbitrary JavaScript within the victim's browser context with scope change across security boundaries. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. Adobe has released APSB26-98 addressing this issue; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript that executes entirely within a victim's browser, bypassing server-side defenses. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed classification (S:C) indicates the injected script can operate beyond the AEM application boundary in the victim's browser context, enabling session hijacking or credential theft from a higher-privileged user. No confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript that executes within a victim's browser session by luring them to a crafted webpage. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, with scope changed - meaning injected scripts can affect resources beyond the immediate AEM origin. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor advisory APSB26-98 covers remediation.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged remote attacker to execute malicious JavaScript in a victim's browser by luring the victim to a crafted URL or page that manipulates the client-side DOM environment. Affected versions span the entire AEM 6.5 line through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. Adobe has addressed this through APSB26-98; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated low-privileged attackers to execute arbitrary JavaScript in victims' browsers by crafting pages that manipulate the DOM environment. Affected deployments include AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. The scope-changed CVSS vector signals that script execution can cross component or trust boundaries within the victim's browser session. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0 allows low-privileged authenticated attackers to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Exploitation requires the victim to visit a crafted webpage, placing this in a social-engineering or insider-threat scenario rather than direct network exploitation. The scope change (S:C) in the CVSS vector confirms the JavaScript executes outside AEM's security boundary in the victim's browser context. No public exploit or CISA KEV listing is identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute arbitrary JavaScript within a victim's browser session by manipulating the DOM environment via a crafted webpage. Affected deployments span AEM as a Cloud Service through July 2026, AEM 6.5 through version 6.5.24, and AEM 6.5 LTS through SP2. No public exploit or active exploitation has been identified at time of analysis; the CVSS score of 5.4 reflects the authentication prerequisite and mandatory victim interaction, though the scope-changed rating indicates the injected script can affect resources outside the AEM application boundary.
DOM-based cross-site scripting in Adobe Experience Manager allows authenticated users to execute malicious JavaScript within their browser context by visiting a crafted webpage. The vulnerability affects AEM as a Cloud Service (up to version 2026.7.0) and on-premises versions (6.5 up to 6.5.24, 6.5 LTS through SP2). With scope changed, the attack can extend beyond the vulnerable component to affect other AEM systems or data. No public exploit code or active exploitation confirmed at time of analysis.
DOM-based cross-site scripting in Adobe Experience Manager 6.5 releases through version 6.5.24 and Cloud Service deployments through 2026.7.0 allows authenticated attackers to execute malicious JavaScript in victims' browsers by injecting attacker-controlled DOM manipulation code into shared content. Successful exploitation harvests session tokens, performs unauthorized actions as the victim, and accesses sensitive data within the victim's authorized scope. The attack requires both attacker authentication and victim user interaction with crafted pages; no active exploitation or public exploits identified at analysis time.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM as a Cloud Service through 2026.7.0 and on-premises AEM 6.5 through 6.5.24 and LTS through SP2. Exploitation requires that a low-privileged attacker socially engineer a target user into visiting a specially crafted URL or page; vendor advisory APSB26-98 confirms the issue and provides patched releases. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute malicious JavaScript within a victim's browser session by manipulating client-side DOM data without server-side interaction. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope-changed nature of the flaw means successful exploitation can affect browser resources beyond the AEM application boundary; no public exploit code or active exploitation has been identified at time of analysis.
Stored XSS in Adobe Experience Manager allows authenticated low-privileged attackers to inject malicious JavaScript into vulnerable form fields that later executes in victims' browsers when they visit the affected page. Affected deployments span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). Adobe has addressed this in security bulletin APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged, network-accessible attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Scope change (S:C) confirms the attack crosses from the application server context into the victim's browser security context, enabling session hijacking, credential theft, or further phishing within the authenticated AEM environment. No public exploit or KEV listing is present at time of analysis; CVSS 5.4 (Medium) reflects the privilege and user-interaction barriers that limit opportunistic mass exploitation.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to persistently inject malicious JavaScript into vulnerable form fields within the CMS. When any victim - including administrators - browses to the page containing the injected payload, the script executes in their browser session under the AEM application's trust boundary, with scope changing to the victim's context. Affected versions span AEM 6.5 ≤6.5.24, AEM as a Cloud Service ≤2026.7.0, and AEM 6.5 LTS ≤SP2, with remediation available via Adobe advisory APSB26-98. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript within a victim's browser by inducing them to visit a crafted URL. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 on-premises (≤6.5.24), as confirmed by EUVD-2026-74147 and Adobe APSB26-98. The scope-change rating reflects that injected script runs in the victim's browser security context, enabling session theft, credential harvesting, or UI redress attacks against higher-privileged users. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows an authenticated low-privileged attacker to inject and execute arbitrary JavaScript within victim browsers by crafting a malicious URL that manipulates the client-side DOM environment. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed CVSS vector (S:C) indicates the injected script can reach resources beyond the AEM application's own security boundary. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment via a crafted webpage. Affected deployments span AEM 6.5 on-premises (≤6.5.24), AEM 6.5 LTS (≤SP2), and AEM as a Cloud Service (≤2026.7.0), as documented in Adobe APSB26-98. The CVSS S:C scope-change designation confirms the payload can escape the vulnerable component's security boundary, enabling session hijacking or cross-origin data exfiltration against privileged AEM users. No public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager 6.5 (through 6.5.24), 6.5 LTS (through SP2), and Cloud Service (through 2026.7.0) enables an authenticated attacker to inject malicious JavaScript that executes in a victim's browser by manipulating client-side DOM state. The scope change (S:C) in the CVSS vector reflects that the injected script runs within the AEM domain's browser context, potentially reaching session tokens, saved credentials, or authoring capabilities beyond the attacker's original privilege level. Exploitation requires the attacker to hold a valid low-privilege AEM account and to socially engineer a victim into visiting a crafted URL; no public exploit code has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL that manipulates the DOM environment. Affected across AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). The scope-changed CVSS vector confirms the script executes outside the originating security context, enabling session theft, credential harvesting, or actions-on-behalf-of-victim against the AEM interface. No public exploit code or CISA KEV listing identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating client-side DOM sinks via a crafted URL. Scope change (S:C) means the injected script executes outside AEM's own origin context, enabling session token theft or privilege escalation against higher-privileged AEM users. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, per Adobe advisory APSB26-98. No public exploit or active exploitation is identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables an authenticated low-privileged attacker to inject and execute malicious JavaScript in a victim's browser by tricking them into visiting a specially crafted URL. The vulnerability spans AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, covering a broad enterprise install base. The CVSS scope-change flag (S:C) is the most significant risk amplifier, indicating injected scripts can reach security contexts beyond the originating AEM application. No public exploit or CISA KEV listing exists at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker with low privileges to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Because scope is changed (S:C per CVSS), the injected script can reach browser resources beyond the AEM origin, enabling session token theft or unauthorized actions performed as the victim. No public exploit code has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged remote attacker to execute malicious JavaScript in a victim's browser by manipulating the DOM environment of a crafted webpage. Affected versions span AEM 6.5 through 6.5.24, AEM as a Cloud Service through the 2026.7.0 release, and AEM 6.5 LTS through SP2. No public exploit or active exploitation has been identified at time of analysis; Adobe has issued advisory APSB26-98 with patch availability.
Stored Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of users who visit the affected pages. Affected deployments include AEM 6.5 through version 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the scope-changed CVSS vector indicates meaningful session and interface impact when exploited.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) allows an authenticated attacker to inject malicious JavaScript into a victim's browser by manipulating the DOM environment through a crafted webpage. The vulnerability affects AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, and carries a scope change meaning injected scripts execute beyond the attacker's origin context. No public exploit identified at time of analysis, and it is not listed in the CISA KEV catalog.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by luring them to a crafted webpage. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and the Cloud Service through the 2026.7.0 release. Scope is changed per the CVSS vector, meaning the exploit crosses the boundary from the AEM application context into the broader browser environment; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation to arbitrary code execution in Adobe Experience Manager (AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2) lets a low-privileged authenticated attacker abuse an incorrect-authorization flaw to execute code and take over a victim's account or session without any user interaction. Because the CVSS scope is changed, the impact extends beyond the vulnerable component. Adobe (PSIRT) rated it 9.9 critical and shipped a fix in APSB26-98; no public exploit is identified at time of analysis.
Sitecore Experience Manager/Platform through version 9.0 contains a deserialization vulnerability enabling code injection through untrusted data processing.
Sitecore PowerShell Extensions through version 7.0 allows authenticated users to upload arbitrary files including ASPX webshells via crafted HTTP requests. The unrestricted file upload bypasses content type restrictions, enabling remote code execution on the Sitecore IIS server with any authenticated account.
Sitecore Experience Manager, Platform, and Commerce versions 9.0 through 10.4 contain a Zip Slip vulnerability that allows authenticated attackers to write arbitrary files outside the intended upload directory. By crafting ZIP archives with path traversal entries, attackers can overwrite application files and achieve remote code execution.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to permanently inject malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Affected deployments include AEM 6.5 LTS up to SP2, AEM 6.5 up to 6.5.24, and AEM as a Cloud Service up to 2026.7.0, per Adobe advisory APSB26-98. No public exploit or active exploitation has been identified at time of analysis, though the low-complexity attack path and broad AEM deployment make this a meaningful persistent threat in content-rich enterprise environments.
Stored Cross-Site Scripting in Adobe Experience Manager 6.5 LTS (≤SP2), AEM 6.5 (≤6.5.24), and AEM as a Cloud Service (≤2026.7.0) allows a low-privileged authenticated attacker to persist malicious JavaScript in vulnerable form fields of the authoring interface. When any other authenticated user visits the page containing the injected payload, the script executes in their browser under the site's origin with a changed scope, enabling session token theft or unauthorized actions on the victim's behalf. No public exploit code or active exploitation is identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who visits the affected page. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has released patches under advisory APSB26-98; no public exploit or CISA KEV listing is identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious scripts into vulnerable form fields. When any user - including administrators - subsequently browses the affected page, the injected JavaScript executes in their browser context, enabling session hijacking, credential theft, or UI redress attacks. Affected versions span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user-including administrators-browses a page containing the injected content, the script executes in their browser, enabling session hijacking, credential theft, or unauthorized actions under the victim's identity. The scope-changed CVSS vector confirms the attack crosses security boundaries, affecting users beyond the injecting account. No public exploit code and no CISA KEV listing are present at time of analysis.
Stored cross-site scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes silently in any victim's browser upon page load. The vulnerability spans AEM 6.5 up to 6.5.24, AEM 6.5 LTS up to SP2, and AEM as a Cloud Service up to build 2026.7.0, per Adobe security bulletin APSB26-98. Because the scope changes to the victim's browser context, a successful injection enables session token theft, credential harvesting, or further client-side attacks against any user - including administrators - who visits the poisoned content.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser when they navigate to the affected page. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through the 2026.7.0 release. The CVSS scope-change flag (S:C) signals that injected scripts escape the AEM application trust boundary and execute in the victim browser's security context; no public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields across the authoring interface. When any victim - including higher-privileged users such as administrators - browses to the page rendering the stored payload, the script executes in their browser, enabling session token theft, unauthorized content manipulation, or further actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis; Adobe has released fixes via security advisory APSB26-98.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which executes in any victim's browser that subsequently navigates to the affected page. The scope-changed CVSS vector (S:C) confirms that injected scripts operate within the victim's browser security context, enabling session hijacking, credential theft, or unauthorized AEM actions against higher-privileged users. Adobe has issued advisory APSB26-98 covering AEM as a Cloud Service, AEM 6.5, and AEM 6.5 LTS; no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Affected versions span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0), as documented in Adobe advisory APSB26-98. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser that renders the affected page. The vulnerability affects AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit code or active exploitation has been identified at time of analysis, and Adobe has addressed this in advisory APSB26-98.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any victim user browses to the affected page, the script executes in their browser within a changed scope context - enabling session theft, credential harvesting, or UI redressing against higher-privileged users. No public exploit code and no CISA KEV listing at time of analysis, but the low complexity and network accessibility make this straightforward to exploit by any authenticated user with form-submission rights.
Stored XSS in Adobe Experience Manager enables a low-privileged authenticated attacker to persistently inject malicious JavaScript into vulnerable form fields within the content authoring interface. When any user - including privileged editors or administrators - navigates to the affected page, the injected script executes in their browser session, potentially enabling session hijacking, credential theft, or unauthorized actions on their behalf. Adobe addressed this under advisory APSB26-98; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields. When any user-including administrators-visits the page containing the injected content, the script executes in their browser under a changed scope (S:C), enabling session theft, credential harvesting, or unauthorized actions on behalf of the victim. Affected are AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. No public exploit or active exploitation is identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields. When any user - including administrators - browses to pages containing the poisoned fields, the injected script executes in their browser under the AEM origin, enabling session token theft, credential harvesting, or UI redirection. Three deployment lines are affected: AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. No public exploit code or active exploitation has been identified at time of analysis.
Improper input validation in Adobe Experience Manager allows a low-privileged remote attacker to bypass a security feature and gain unauthorized limited write access to the platform. Affected deployments span AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 through 6.5.24. Exploitation requires social engineering - a logged-in victim must visit a crafted URL or interact with a compromised web page - constraining real-world reach. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables authenticated low-privilege attackers to inject and execute arbitrary JavaScript within a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope-changed CVSS vector indicates successful exploitation can cross session boundaries, enabling session token theft or unauthorized actions beyond the attacker's direct privilege level - though exploitation requires both a valid AEM credential and victim interaction via a crafted page. No public exploit code and no CISA KEV listing exist at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables authenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM sinks without sanitization. Affected releases span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe addressed this in security bulletin APSB26-98; no confirmed active exploitation or public proof-of-concept code has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated low-privilege attackers to execute arbitrary JavaScript in the browser context of targeted users who visit a crafted webpage. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through the 2026.7.0 release. Adobe addressed this in advisory APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by manipulating the DOM environment through a crafted webpage. Affected versions span AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 through 6.5.24. No public exploit code or active exploitation has been identified at time of analysis; vendor patch is documented under Adobe APSB26-98.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to inject malicious JavaScript that executes within a victim's browser context, with scope changing beyond AEM's own origin. Three product lines are affected: AEM 6.5, AEM 6.5 LTS, and AEM as a Cloud Service through their respective latest releases at time of disclosure. Exploitation requires user interaction - the victim must navigate to an attacker-crafted URL while authenticated - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM sinks. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), per Adobe advisory APSB26-98. The scope-changed CVSS vector indicates impact can extend beyond the AEM application boundary into the victim's broader browser session; no public exploit has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment via a crafted URL or webpage. All three AEM delivery models are affected - on-premises 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has published Security Bulletin APSB26-98 addressing this issue; no public exploit code and no CISA KEV listing have been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to execute arbitrary JavaScript within a victim's browser by enticing them to visit a crafted URL. All currently supported AEM deployment models are affected - Cloud Service through 2026.7.0, on-premises 6.5 through 6.5.24, and 6.5 LTS through SP2. The scope change in the CVSS vector indicates the JavaScript executes in a context beyond the vulnerable component itself, potentially enabling session hijacking or privilege escalation within the AEM environment. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
DOM-based XSS in Adobe Experience Manager enables an authenticated attacker to inject malicious JavaScript that executes within a victim's browser by manipulating client-side DOM sinks on crafted or attacker-influenced AEM pages. Affected deployments span AEM 6.5 on-premises through version 6.5.24, the 6.5 LTS track through SP2, and AEM as a Cloud Service through the 2026.7.0 release channel. Adobe has addressed the issue in advisory APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a network-adjacent, low-privileged attacker to execute arbitrary JavaScript within a victim's browser session by luring them to a crafted webpage. The vulnerability arises from unsanitized attacker-controlled data being written into the DOM without server-side involvement, enabling script execution in a changed security scope (S:C). Exploitation requires user interaction and no public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) enables an authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating client-side DOM sources and sinks via a crafted webpage. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 (≤6.5.24), and AEM 6.5 LTS (≤SP2), as confirmed by Adobe APSB26-98. The CVSS scope-change metric (S:C) indicates the payload escapes the AEM application context and can affect the victim's broader browser environment; no public exploit identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated, low-privileged attacker to execute arbitrary JavaScript in a victim's browser session by inducing that authenticated user to visit a crafted webpage. Affected versions span AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. The CVSS scope-change indicator (S:C) reflects that injected scripts execute within the victim's browser context, potentially enabling session theft, credential harvesting, or actions performed on behalf of the victim beyond the AEM application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to execute arbitrary JavaScript in a victim's browser by luring the victim to a crafted webpage. Affected are AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope-changed impact means the malicious script executes outside the originating application boundary, enabling session hijacking, credential theft, or UI redressing against authenticated AEM users. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary JavaScript within a victim's browser session by delivering a crafted URL that manipulates the client-side DOM environment. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The CVSS scope change (S:C) indicates the injected script executes in a different browser security context than the attacker's origin, enabling cross-context session abuse. No public exploit or CISA KEV listing is present at time of analysis.
DOM-based XSS in Adobe Experience Manager allows authenticated low-privileged attackers to inject malicious JavaScript into a victim's browser by luring them to a specially crafted URL that manipulates the client-side DOM without server-side involvement. Affected versions include AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has issued a fix under advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to inject and execute arbitrary JavaScript within a victim's browser by enticing them to visit a crafted URL or page, with scope change enabling cross-context impact. Affected versions include AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0, all addressed under Adobe Security Bulletin APSB26-98. No public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to inject malicious JavaScript into a victim's browser by manipulating the DOM environment through a crafted webpage. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit has been identified at time of analysis; Adobe has published security bulletin APSB26-98 addressing this issue.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to execute arbitrary JavaScript in a victim's browser by delivering a specially crafted URL or page that exploits client-side DOM processing. Affected are AEM 6.5 LTS through SP2, AEM 6.5 on-premise through 6.5.24, and AEM as a Cloud Service through the 2026.7.0 release. Successful exploitation enables session hijacking, credential theft, or unauthorized actions performed within the AEM environment on behalf of the victim, with scope change indicating impact crosses from the web application into the victim's browser context.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted webpage that manipulates the client-side DOM environment. The scope-changed CVSS vector (S:C) confirms the malicious script executes in the victim's browser security context rather than the server, enabling session hijacking, credential theft, or UI redress against AEM users. Reported directly by Adobe PSIRT and addressed in advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to manipulate client-side DOM variables to inject and execute arbitrary JavaScript within a victim's browser session. Affected are AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, per Adobe advisory APSB26-98. The scope change in the CVSS vector indicates that injected scripts can reach browser resources outside the AEM application origin, enabling session hijacking or cross-application data theft when a victim clicks a crafted link.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a network-accessible, low-privileged attacker to inject malicious JavaScript that executes entirely within a victim's browser session by manipulating the DOM environment. Affected versions span the AEM 6.5 branch (≤6.5.24), the 6.5 LTS edition (≤SP2), and AEM as a Cloud Service (≤2026.7.0), covering a broad enterprise install base. The CVSS vector confirms a scope change (S:C), meaning successful exploitation can affect browser resources beyond the originating AEM page - such as session tokens or cross-frame content - though user interaction via a crafted webpage visit is required for the attack to succeed.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) enables authenticated attackers with low-level access to inject malicious JavaScript into victim browsers, achieving a scope change that allows cross-origin script execution. Affected versions span AEM as a Cloud Service ≤2026.7.0, AEM 6.5 LTS ≤SP2, and AEM 6.5 ≤6.5.24, as confirmed by Adobe advisory APSB26-98. Exploitation requires user interaction; no public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject malicious JavaScript that executes inside a victim's browser when the victim visits a specially crafted URL or page hosted within the AEM environment. Affects AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. No public exploit identified at time of analysis; Adobe has released patches via advisory APSB26-98.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by directing the victim to a crafted webpage that manipulates the AEM client-side DOM environment. Affected releases span AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. The scope-changed impact means the injected script operates outside AEM's own origin boundary, enabling session theft or unauthorized actions against the authenticated victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) allows a low-privileged attacker to execute arbitrary JavaScript within a victim's browser by luring them to a crafted webpage that manipulates the client-side DOM environment. Affected versions span AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. The vulnerability carries a scope-change flag (S:C), indicating the injected script can affect browser context beyond AEM's own page, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating the DOM environment through a crafted webpage. Affected are AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit or KEV listing has been identified at time of analysis; exploitation requires both attacker authentication (PR:L) and victim interaction with a crafted URL or page.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript within a victim's browser by enticing them to visit a specially crafted URL. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the July 2026 (2026.7.0) release, with Adobe addressing this in security bulletin APSB26-98. The CVSS scope-change metric (S:C) reflects that successful exploitation crosses the AEM application boundary into the victim's browser context, enabling session hijacking, credential theft, or forced authenticated actions - no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject and execute arbitrary JavaScript in victims' browsers after social-engineering them into visiting a crafted webpage. Affected versions span AEM as a Cloud Service up to 2026.7.0, AEM 6.5 up to 6.5.24, and AEM 6.5 LTS up to SP2. The CVSS scope-change indicator (S:C) means injected scripts can reach browser contexts beyond the AEM origin, elevating potential impact to cross-origin session theft or privilege escalation within the CMS authoring environment. No public exploit or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2 enables authenticated low-privileged attackers to inject and execute arbitrary JavaScript in a victim's browser by manipulating the Document Object Model client-side. The scope change (S:C in the CVSS vector) confirms that successful exploitation escapes AEM's own security boundary, allowing the injected script to access browser-resident resources such as cookies, localStorage, or cross-origin-accessible DOM of other open pages. Exploitation requires a victim with a valid AEM session to be social-engineered into visiting a crafted URL, making this a realistic privilege-escalation vector from author/editor to administrator in enterprise AEM deployments. No public exploit code or CISA KEV listing identified at time of analysis; vendor advisory APSB26-98 is available.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated remote attackers to execute arbitrary JavaScript in a victim's browser by manipulating the DOM environment of a crafted webpage the victim is induced to visit. Affected deployments span AEM 6.5 on-premises through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has released a remediation via advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute arbitrary JavaScript within a victim's browser session by manipulating the client-side DOM environment. Affected versions span the AEM 6.5 branch (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). Exploitation requires the attacker to hold a low-privileged AEM account and socially engineer a target user into visiting a crafted URL; no public exploit or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by manipulating the client-side DOM environment, achieving a scope change that can affect resources beyond the AEM origin. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), covering both cloud and on-premises enterprise installations. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires a victim to interact with a crafted webpage delivered by the attacker.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript in a victim's browser by inducing them to visit a crafted URL that manipulates client-side DOM sinks. Affected deployments span AEM 6.5 on-premises through version 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The CVSS scope-change (S:C) indicates injected scripts execute outside the vulnerable component's security boundary, enabling session theft or privileged action execution within the AEM browser origin. No public exploit or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript in a victim's browser session by luring the victim to a crafted URL or webpage. Affected deployments span Adobe Experience Manager 6.5 (through 6.5.24), Experience Manager 6.5 LTS (through SP2), and the Experience Manager as a Cloud Service (through the 2026.7.0 release). The scope-change designation confirms the malicious script executes outside the AEM server context - in the victim's browser - enabling session token theft, credential harvesting, or unauthorized AEM actions on behalf of the victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) enables a low-privileged authenticated attacker to inject malicious JavaScript into a victim's browser by manipulating client-side DOM sources before they reach execution sinks. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release; Adobe has addressed this through security advisory APSB26-98. The CVSS scope-change flag (S:C) reflects that successful exploitation crosses the boundary from the vulnerable AEM application into the victim's browser context, enabling session hijacking or unauthorized content manipulation on behalf of higher-privileged users.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated, low-privileged attacker to inject and execute malicious JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM sources. Affected deployments span AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 through 6.5.24. The CVSS scope-change designation (S:C) indicates injected script can reach browser context beyond the AEM application boundary; no public exploit has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by directing them to a crafted URL, with scope change enabling cross-context impact beyond the AEM application itself. Affected deployments span AEM 6.5 LTS up to SP2, AEM 6.5 up to version 6.5.24, and AEM as a Cloud Service up to the 2026.7.0 release. No public exploit code or active exploitation has been confirmed at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to inject and execute malicious JavaScript in a victim's browser by luring them to a crafted webpage that manipulates the client-side DOM environment. Affected are AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), per Adobe advisory APSB26-98. The scope-change designation (S:C) indicates injected scripts can reach browser resources beyond AEM's own application boundary, enabling session theft or cross-origin actions. No public exploit or CISA KEV listing is present at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM processing. Affected versions include AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. Exploitation requires user interaction (victim must visit the crafted page), and the scope change in the CVSS vector (S:C) confirms the attack can affect resources beyond the immediate AEM application context. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript within a victim's browser session after tricking that user into visiting a crafted page. The vulnerability spans AEM as a Cloud Service (≤2026.7.0), AEM 6.5 on-premises (≤6.5.24), and AEM 6.5 LTS (≤SP2), covering all major supported deployment tracks. Adobe has released remediation via Security Bulletin APSB26-98; no confirmed active exploitation or public exploit code is recorded at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables a low-privileged attacker to inject and execute arbitrary JavaScript within a victim's browser session by manipulating the DOM environment through a crafted webpage. The vulnerability affects AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, with scope change indicating the malicious script can reach beyond AEM's own security context into the victim's broader browser environment. Adobe has addressed this in advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject malicious JavaScript that executes within a victim's browser session by manipulating the DOM environment client-side. Affecting AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, exploitation requires the victim to visit a specially crafted webpage, making social engineering a necessary step. Adobe has released APSB26-98 addressing all three product lines; no public exploit or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privileged attackers to execute arbitrary JavaScript within a victim's browser by inducing them to visit a specially crafted AEM webpage, with the scope crossing the AEM origin boundary into the browser's security context. All three supported deployment tracks are affected: AEM as a Cloud Service through the 2026.7.0 release cycle, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. Adobe addressed this under advisory APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL or page that manipulates the client-side DOM. Affected deployments span AEM 6.5 on-premises (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0), covering a broad range of enterprise CMS installations. The scope-changed CVSS vector (S:C) signals that the script executes beyond the AEM application context - enabling session hijacking, credential theft, or action-on-behalf-of attacks targeting higher-privilege users. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to deliver a crafted URL that, when visited by an authenticated victim, executes arbitrary JavaScript within the victim's browser context with scope change across security boundaries. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. Adobe has released APSB26-98 addressing this issue; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript that executes entirely within a victim's browser, bypassing server-side defenses. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed classification (S:C) indicates the injected script can operate beyond the AEM application boundary in the victim's browser context, enabling session hijacking or credential theft from a higher-privileged user. No confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript that executes within a victim's browser session by luring them to a crafted webpage. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, with scope changed - meaning injected scripts can affect resources beyond the immediate AEM origin. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor advisory APSB26-98 covers remediation.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged remote attacker to execute malicious JavaScript in a victim's browser by luring the victim to a crafted URL or page that manipulates the client-side DOM environment. Affected versions span the entire AEM 6.5 line through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. Adobe has addressed this through APSB26-98; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated low-privileged attackers to execute arbitrary JavaScript in victims' browsers by crafting pages that manipulate the DOM environment. Affected deployments include AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. The scope-changed CVSS vector signals that script execution can cross component or trust boundaries within the victim's browser session. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0 allows low-privileged authenticated attackers to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Exploitation requires the victim to visit a crafted webpage, placing this in a social-engineering or insider-threat scenario rather than direct network exploitation. The scope change (S:C) in the CVSS vector confirms the JavaScript executes outside AEM's security boundary in the victim's browser context. No public exploit or CISA KEV listing is identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute arbitrary JavaScript within a victim's browser session by manipulating the DOM environment via a crafted webpage. Affected deployments span AEM as a Cloud Service through July 2026, AEM 6.5 through version 6.5.24, and AEM 6.5 LTS through SP2. No public exploit or active exploitation has been identified at time of analysis; the CVSS score of 5.4 reflects the authentication prerequisite and mandatory victim interaction, though the scope-changed rating indicates the injected script can affect resources outside the AEM application boundary.
DOM-based cross-site scripting in Adobe Experience Manager allows authenticated users to execute malicious JavaScript within their browser context by visiting a crafted webpage. The vulnerability affects AEM as a Cloud Service (up to version 2026.7.0) and on-premises versions (6.5 up to 6.5.24, 6.5 LTS through SP2). With scope changed, the attack can extend beyond the vulnerable component to affect other AEM systems or data. No public exploit code or active exploitation confirmed at time of analysis.
DOM-based cross-site scripting in Adobe Experience Manager 6.5 releases through version 6.5.24 and Cloud Service deployments through 2026.7.0 allows authenticated attackers to execute malicious JavaScript in victims' browsers by injecting attacker-controlled DOM manipulation code into shared content. Successful exploitation harvests session tokens, performs unauthorized actions as the victim, and accesses sensitive data within the victim's authorized scope. The attack requires both attacker authentication and victim user interaction with crafted pages; no active exploitation or public exploits identified at analysis time.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM as a Cloud Service through 2026.7.0 and on-premises AEM 6.5 through 6.5.24 and LTS through SP2. Exploitation requires that a low-privileged attacker socially engineer a target user into visiting a specially crafted URL or page; vendor advisory APSB26-98 confirms the issue and provides patched releases. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute malicious JavaScript within a victim's browser session by manipulating client-side DOM data without server-side interaction. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope-changed nature of the flaw means successful exploitation can affect browser resources beyond the AEM application boundary; no public exploit code or active exploitation has been identified at time of analysis.
Stored XSS in Adobe Experience Manager allows authenticated low-privileged attackers to inject malicious JavaScript into vulnerable form fields that later executes in victims' browsers when they visit the affected page. Affected deployments span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). Adobe has addressed this in security bulletin APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged, network-accessible attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Scope change (S:C) confirms the attack crosses from the application server context into the victim's browser security context, enabling session hijacking, credential theft, or further phishing within the authenticated AEM environment. No public exploit or KEV listing is present at time of analysis; CVSS 5.4 (Medium) reflects the privilege and user-interaction barriers that limit opportunistic mass exploitation.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to persistently inject malicious JavaScript into vulnerable form fields within the CMS. When any victim - including administrators - browses to the page containing the injected payload, the script executes in their browser session under the AEM application's trust boundary, with scope changing to the victim's context. Affected versions span AEM 6.5 ≤6.5.24, AEM as a Cloud Service ≤2026.7.0, and AEM 6.5 LTS ≤SP2, with remediation available via Adobe advisory APSB26-98. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript within a victim's browser by inducing them to visit a crafted URL. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 on-premises (≤6.5.24), as confirmed by EUVD-2026-74147 and Adobe APSB26-98. The scope-change rating reflects that injected script runs in the victim's browser security context, enabling session theft, credential harvesting, or UI redress attacks against higher-privileged users. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows an authenticated low-privileged attacker to inject and execute arbitrary JavaScript within victim browsers by crafting a malicious URL that manipulates the client-side DOM environment. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed CVSS vector (S:C) indicates the injected script can reach resources beyond the AEM application's own security boundary. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment via a crafted webpage. Affected deployments span AEM 6.5 on-premises (≤6.5.24), AEM 6.5 LTS (≤SP2), and AEM as a Cloud Service (≤2026.7.0), as documented in Adobe APSB26-98. The CVSS S:C scope-change designation confirms the payload can escape the vulnerable component's security boundary, enabling session hijacking or cross-origin data exfiltration against privileged AEM users. No public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager 6.5 (through 6.5.24), 6.5 LTS (through SP2), and Cloud Service (through 2026.7.0) enables an authenticated attacker to inject malicious JavaScript that executes in a victim's browser by manipulating client-side DOM state. The scope change (S:C) in the CVSS vector reflects that the injected script runs within the AEM domain's browser context, potentially reaching session tokens, saved credentials, or authoring capabilities beyond the attacker's original privilege level. Exploitation requires the attacker to hold a valid low-privilege AEM account and to socially engineer a victim into visiting a crafted URL; no public exploit code has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL that manipulates the DOM environment. Affected across AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). The scope-changed CVSS vector confirms the script executes outside the originating security context, enabling session theft, credential harvesting, or actions-on-behalf-of-victim against the AEM interface. No public exploit code or CISA KEV listing identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating client-side DOM sinks via a crafted URL. Scope change (S:C) means the injected script executes outside AEM's own origin context, enabling session token theft or privilege escalation against higher-privileged AEM users. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, per Adobe advisory APSB26-98. No public exploit or active exploitation is identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables an authenticated low-privileged attacker to inject and execute malicious JavaScript in a victim's browser by tricking them into visiting a specially crafted URL. The vulnerability spans AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, covering a broad enterprise install base. The CVSS scope-change flag (S:C) is the most significant risk amplifier, indicating injected scripts can reach security contexts beyond the originating AEM application. No public exploit or CISA KEV listing exists at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker with low privileges to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Because scope is changed (S:C per CVSS), the injected script can reach browser resources beyond the AEM origin, enabling session token theft or unauthorized actions performed as the victim. No public exploit code has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged remote attacker to execute malicious JavaScript in a victim's browser by manipulating the DOM environment of a crafted webpage. Affected versions span AEM 6.5 through 6.5.24, AEM as a Cloud Service through the 2026.7.0 release, and AEM 6.5 LTS through SP2. No public exploit or active exploitation has been identified at time of analysis; Adobe has issued advisory APSB26-98 with patch availability.
Stored Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of users who visit the affected pages. Affected deployments include AEM 6.5 through version 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the scope-changed CVSS vector indicates meaningful session and interface impact when exploited.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) allows an authenticated attacker to inject malicious JavaScript into a victim's browser by manipulating the DOM environment through a crafted webpage. The vulnerability affects AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, and carries a scope change meaning injected scripts execute beyond the attacker's origin context. No public exploit identified at time of analysis, and it is not listed in the CISA KEV catalog.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by luring them to a crafted webpage. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and the Cloud Service through the 2026.7.0 release. Scope is changed per the CVSS vector, meaning the exploit crosses the boundary from the AEM application context into the broader browser environment; no public exploit or CISA KEV listing has been identified at time of analysis.