Description
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Published: 2026-10-13
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting that executes malicious JavaScript in the victim’s browser
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a DOM‑based Cross‑Site Scripting flaw that allows an attacker to inject and run arbitrary JavaScript inside a victim’s browser when the victim loads a crafted web page. This can be used to hijack user sessions, steal credentials, or manipulate page content. The flaw requires user interaction and involves a change in scope.

Affected Systems

Adobe Experience Manager version 6.5 is affected. Administrators of this product should verify whether their environment includes the released Adobe patch that addresses this vulnerability.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate impact, and the publicly available EPSS is not listed, making it unclear how quickly this flaw is being exploited. It is not currently included in CISA’s KEV catalog. Exploitation requires the victim to visit a maliciously crafted page, making user interaction necessary. Although the risk is moderate, the presence of a changed scope suggests that the vulnerability could potentially have wider implications than a single session compromise.

Generated by OpenCVE AI on October 13, 2026 at 22:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Adobe Experience Manager security patch that addresses this DOM‑based XSS.
  • Implement a strict Content Security Policy that disallows inline JavaScript and restricts script sources to trusted domains.
  • Ensure any data inserted into the DOM is properly sanitized or encoded to prevent script execution.

Generated by OpenCVE AI on October 13, 2026 at 22:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 31 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*

Fri, 16 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe adobe Experience Manager
Adobe experience Manager
Vendors & Products Adobe
Adobe adobe Experience Manager
Adobe experience Manager

Tue, 13 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Description Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Title Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Adobe Adobe Experience Manager Experience Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-10-13T20:04:02.600Z

Reserved: 2026-05-21T15:28:38.143Z

Link: CVE-2026-48398

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T20:17:29.137

Modified: 2026-10-31T00:58:39.527

Link: CVE-2026-48398

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T13:06:00Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')