Description
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Published: 2026-07-14
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Adobe Experience Manager is vulnerable to a DOM-based Cross‑Site Scripting flaw that allows an attacker to inject and execute arbitrary JavaScript in the victim’s browser. The vulnerability relies on manipulating the DOM environment via a crafted page and requires that the user visit that page. Scope is changed.

Affected Systems

The flaw affects Adobe Experience Manager 6.5, Adobe Experience Manager 6.5 LTS, and Adobe Experience Manager as a Cloud Service. Users of any of these versions should verify that their installations are running the patched release referenced in Adobe APSB26‑74.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate overall severity. The EPSS of less than 1% suggests a very low likelihood of widespread exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves a crafted webpage that the victim must visit, triggering JavaScript execution in the browser context of the trusted Adobe Experience Manager domain.

Generated by OpenCVE AI on July 31, 2026 at 05:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official Adobe patch or upgrade to a patched release as documented in Adobe APSB26‑74.
  • Configure a strict Content Security Policy that disallows inline scripts and restricts external script sources to a whitelist.
  • Add client‑side validation and encoding of any data used in DOM manipulation, ensuring that user‑supplied input cannot alter the page’s JavaScript context.

Generated by OpenCVE AI on July 31, 2026 at 05:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 15 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
Description Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Title Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-07-15T19:38:46.411Z

Reserved: 2026-05-21T15:28:38.131Z

Link: CVE-2026-48262

cve-icon Vulnrichment

Updated: 2026-07-15T14:06:50.261Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T05:45:03Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')