Description
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Published: 2026-06-09
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A DOM‑based Cross‑Site Scripting vulnerability exists in Adobe Experience Manager. An attacker can manipulate the browser’s DOM environment by directing a victim to a malicious URL, causing arbitrary JavaScript to execute within the victim’s browser context. The attack requires user interaction and changes the scope of the vulnerability.

Affected Systems

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier.

Risk and Exploitability

The CVSS score of 5.4 indicates a moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a victim to visit a crafted webpage; the typical attack vector is a malicious link or embedded content that induces the victim’s browser to parse and execute script via the DOM.

Generated by OpenCVE AI on June 9, 2026 at 20:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Adobe Experience Manager to the latest release that addresses the DOM‑based XSS flaw.
  • If an immediate upgrade is not possible, deploy a content security policy that disallows inline scripts and restricts trusted origins for executable code.
  • Educate end users and administrators to avoid clicking suspicious URLs and to verify the authenticity of web pages before interaction.

Generated by OpenCVE AI on June 9, 2026 at 20:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 10 Jun 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe adobe Experience Manager
Vendors & Products Adobe
Adobe adobe Experience Manager

Tue, 09 Jun 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 09 Jun 2026 17:15:00 +0000

Type Values Removed Values Added
Description Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Title Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Adobe Adobe Experience Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-06-09T18:38:01.129Z

Reserved: 2026-05-21T15:28:38.131Z

Link: CVE-2026-48268

cve-icon Vulnrichment

Updated: 2026-06-09T18:36:11.316Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-06-09T17:17:43.237

Modified: 2026-06-09T19:30:24.713

Link: CVE-2026-48268

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-10T00:00:10Z

Weaknesses