Description
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Published: 2026-06-09
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a stored cross‑site scripting flaw in Adobe Experience Manager that allows a low‑privileged attacker to inject malicious JavaScript into vulnerable form fields. When a user visits a page that contains the stored data, the injected script executes in that user’s browser.

Affected Systems

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and all earlier releases are affected. These versions are used by organizations that provide web content through Adobe Experience Manager’s form‑handling capabilities.

Risk and Exploitability

The CVSS score of 5.4 indicates a moderate risk. The EPSS score is not available, so the current exploitation probability is unknown. The issue is not listed in CISA’s KEV catalog. The flaw only requires an attacker to have low‑privilege access to submit a form; once the payload is stored, any user who views the affected page will have the malicious script executed in their browser.

Generated by OpenCVE AI on June 9, 2026 at 21:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the patch provided in Adobe Product Security Bulletin APSB26-56 to remove the stored XSS flaw.
  • Upgrade to a version of Adobe Experience Manager released after 6.5.24, LTS SP1, and 2026.04.
  • Implement server‑side input validation and output encoding for all form fields to prevent the injection of malicious scripts.

Generated by OpenCVE AI on June 9, 2026 at 21:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 10 Jun 2026 02:00:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe adobe Experience Manager
Vendors & Products Adobe
Adobe adobe Experience Manager

Tue, 09 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 09 Jun 2026 17:15:00 +0000

Type Values Removed Values Added
Description Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Title Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Adobe Adobe Experience Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-06-09T18:38:10.528Z

Reserved: 2026-05-20T15:50:31.362Z

Link: CVE-2026-47939

cve-icon Vulnrichment

Updated: 2026-06-09T18:36:09.030Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-06-09T17:17:37.523

Modified: 2026-06-09T19:30:24.713

Link: CVE-2026-47939

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-10T01:45:18Z

Weaknesses