Description
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Published: 2026-06-09
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Adobe Experience Manager versions 6.5.24, LTS SP1, and 2026.04, along with all earlier releases, contain a stored cross‑site scripting flaw that permits a low‑privileged attacker to insert arbitrary script into form fields. When a user accesses a page containing the compromised form, the injected JavaScript runs within the victim’s browser, enabling client‑side compromise.

Affected Systems

The vulnerability exists in Adobe Experience Manager deployments using the identified versions. Administrators should confirm the version of AEM in use and apply the relevant Adobe advisory updates.

Risk and Exploitability

The CVSS score of 5.4 denotes moderate severity. No EPSS score is available, so the likelihood of exploitation is unknown; the flaw is not listed in CISA’s KEV catalog, indicating no widespread exploitation currently. The change of scope suggests that the attack could affect additional components beyond the directly used form.

Generated by OpenCVE AI on June 9, 2026 at 21:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Adobe Experience Manager to a version that is not affected by this vulnerability, as specified on Adobe’s security advisory page.
  • If an update cannot be applied immediately, prevent script input in the vulnerable form fields by enforcing strict server‑side validation or by blocking script‑tags using a web application firewall.
  • Ensure that any content returned from form submissions is properly encoded before rendering it to the browser to mitigate injection risks.

Generated by OpenCVE AI on June 9, 2026 at 21:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 09 Jun 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 09 Jun 2026 17:15:00 +0000

Type Values Removed Values Added
Description Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Title Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-06-09T20:14:42.816Z

Reserved: 2026-05-20T15:50:31.364Z

Link: CVE-2026-47957

cve-icon Vulnrichment

Updated: 2026-06-09T20:14:33.084Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-06-09T17:17:39.490

Modified: 2026-06-09T19:30:24.713

Link: CVE-2026-47957

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-09T21:30:13Z

Weaknesses