CVE-2026-47935: Adobe Experience Manager DOM-based XSS Vulnerability (CVSS 5.4)

Technical summary

This is a DOM-based XSS vulnerability (CWE-79) in Adobe Experience Manager that arises from improper handling of untrusted input in the Document Object Model. Unlike stored or reflected XSS, the vulnerability manifests when client-side JavaScript processes attacker-controlled data without adequate sanitization or encoding. The attack vector is network-based with low complexity; it requires user interaction (visiting a malicious link) and valid AEM credentials (PR:L in the CVSS vector). The scope change indicates the attack can affect resources beyond the vulnerable component's original security boundary. The vulnerability scored CVSS 5.4 (Medium severity) with limited confidentiality and integrity impact but no availability impact.

Business impact

Organizations running vulnerable AEM versions face session hijacking and credential theft risks if users are socially engineered into visiting attacker-controlled pages. Since AEM commonly manages digital content, marketing collateral, and customer-facing websites, a successful XSS attack could deface content, harvest visitor data, or redirect users to malicious sites. The requirement for user interaction limits the attack surface to phishing campaigns or malicious advertisements, but the broad adoption of AEM in enterprise environments makes this a meaningful concern. The scope change means an attacker's payload could potentially exfiltrate data or perform actions across different security domains within the AEM installation.

Affected systems

Adobe Experience Manager versions 6.5.24, LTS SP1 (all variants through the specified patch levels), and 2026.04 and earlier versions are vulnerable. Organizations should inventory all AEM deployments, including on-premises and cloud-hosted instances, to determine exposure. Patches or security updates from Adobe are required to remediate; verify the exact affected version lineage and available patched versions against Adobe's official security advisory.

Exploitability

Exploitability is moderate. The attack requires a valid AEM user to be present and actively using the application, then become the target of a social engineering campaign (phishing, watering hole, malicious ad). There is no evidence of public exploit code or active exploitation in the wild at this time—the vulnerability is not tracked in the Known Exploited Vulnerabilities (KEV) catalog. However, DOM-based XSS techniques are well-understood, and a determined attacker with basic web security knowledge could craft an effective payload. The low complexity and network accessibility make this a realistic threat if users are not security-aware.

Remediation

Apply the latest security patches from Adobe for your specific AEM version line (6.5.x, LTS, or 2026.x). Verify patch availability and deployment instructions in Adobe's official security advisory. Beyond patching, implement input validation and output encoding best practices in any custom AEM components or extensions. Consider Content Security Policy (CSP) headers to restrict inline script execution. Conduct user awareness training to reduce phishing and social engineering susceptibility, since user interaction is required for exploitation.

Patch guidance

Contact Adobe support or check the official Adobe Security Advisories page for the specific patch version applicable to your AEM deployment. Do not rely on version numbers inferred from this advisory; verify all patch details directly against Adobe's published guidance. Test patches in a staging environment before production rollout. If you are running 6.5.24, LTS SP1, or 2026.04, you are confirmed vulnerable and should prioritize patching.

Detection guidance

Monitor web application firewall (WAF) logs and AEM access logs for suspicious DOM manipulation patterns, unusual JavaScript execution, or requests containing encoded script payloads. Look for HTTP requests with parameters that include HTML entities or JavaScript syntax targeting known AEM DOM endpoints. Implement endpoint detection and response (EDR) to flag processes spawning unexpected child processes or making unusual outbound connections following user interaction with AEM. Consider deploying browser-based isolation or sandboxing for high-risk users to contain XSS payload execution.

Why prioritize this

Although scored CVSS 5.4 (Medium), this vulnerability warrants prompt attention because AEM is widely deployed in enterprises, the attack vector is network-accessible and easy to exploit, and the scope change increases impact surface. The lack of KEV designation and active exploits provides a window to patch before widespread weaponization. Organizations managing customer-facing digital properties should prioritize this above lower-risk issues affecting internal-only systems.

Risk score, explained

The CVSS 5.4 score reflects network accessibility (AV:N) and low attack complexity (AC:L), offset by the requirement for user interaction (UI:R) and valid login credentials (PR:L). Confidentiality and integrity are slightly impacted (C:L, I:L), but availability is not affected (A:N). The scope change (S:C) increases the score by allowing cross-boundary attacks, elevating the severity from Low to Medium. In context, this is a realistic but not critical threat requiring timely but not emergency-level response.

Frequently asked questions