Description
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Published: 2026-09-08
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: DOM-based Cross-site Scripting
Action: Apply Patch
AI Analysis

Impact

Adobe Experience Manager has a DOM-based Cross-Site Scripting vulnerability. An attacker could inject and execute malicious JavaScript in the victim’s browser by manipulating the DOM. Exploitation requires the victim to visit a specially crafted webpage and causes a change in scope.

Affected Systems

Adobe Experience Manager 6.5, Adobe Experience Manager 6.5 LTS, and Adobe Experience Manager as a Cloud Service are susceptible.

Risk and Exploitability

The CVSS score is 5.4, indicating moderate risk. Exploitation requires user interaction, so phishing or a malicious link is the likely vector. EPSS data is not available, and the vulnerability is not listed in CISA KEV, so widespread exploitation has not been reported. The scope change warrants timely attention.

Generated by OpenCVE AI on September 9, 2026 at 13:04 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Adobe Experience Manager to the latest version referenced in Adobe Security Advisory APSB26-98
  • Implement context‑aware encoding or sanitization for all user‑supplied data to prevent DOM manipulation
  • Deploy web‑application firewall rules that detect and block malicious script injection attempts

Generated by OpenCVE AI on September 9, 2026 at 13:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe experience Manager
CPEs cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*
cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*
cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*
cpe:2.3:a:adobe:experience_manager:6.5:sp1:*:*:lts:*:*:*
cpe:2.3:a:adobe:experience_manager:6.5:sp2:*:*:lts:*:*:*
Vendors & Products Adobe
Adobe experience Manager

Tue, 08 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Description Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Title Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Adobe Experience Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-09-11T21:20:24.974Z

Reserved: 2026-08-18T01:29:54.617Z

Link: CVE-2026-75683

cve-icon Vulnrichment

Updated: 2026-09-11T21:20:19.491Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-08T20:18:16.443

Modified: 2026-09-11T22:16:40.673

Link: CVE-2026-75683

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-09T13:15:12Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')