Description
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Published: 2026-06-09
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a DOM‑based Cross‑Site Scripting flaw in Adobe Experience Manager. An attacker can craft a page and force a victim’s browser to execute arbitrary JavaScript. The flaw requires user interaction and can change the security scope of the affected environment.

Affected Systems

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected. All installations of the aforementioned releases running on any supported platform are at risk.

Risk and Exploitability

The CVSS score of 5.4 suggests a moderate severity. No EPSS score is reported, making it unclear how frequently this flaw is exploited in the wild. The flaw is not listed in CISA’s KEV catalog, indicating limited known exploitation. The likely attack vector is a user visiting a crafted URL, after which malicious script runs in the victim’s browser.

Generated by OpenCVE AI on June 9, 2026 at 20:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Adobe Experience Manager to a version later than 2026.04 or apply the latest security patch addressing APSB26‑56.
  • If an immediate patch is not available, enforce a Content Security Policy that disallows inline scripts and restricts trusted script sources.
  • Sanitize or encode any user‑controlled input that is incorporated into the DOM to prevent script injection.

Generated by OpenCVE AI on June 9, 2026 at 20:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 10 Jun 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Adobe experience Manager
CPEs cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*
cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*
cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*
cpe:2.3:a:adobe:experience_manager:6.5:sp1:*:*:lts:*:*:*
Vendors & Products Adobe experience Manager

Wed, 10 Jun 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 10 Jun 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe adobe Experience Manager
Vendors & Products Adobe
Adobe adobe Experience Manager

Tue, 09 Jun 2026 17:15:00 +0000

Type Values Removed Values Added
Description Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Title Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Adobe Adobe Experience Manager Experience Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-06-10T13:55:42.246Z

Reserved: 2026-05-21T15:28:38.131Z

Link: CVE-2026-48265

cve-icon Vulnrichment

Updated: 2026-06-10T13:55:38.460Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-09T17:17:42.970

Modified: 2026-06-10T14:49:58.713

Link: CVE-2026-48265

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-10T00:00:10Z

Weaknesses