CVE-2026-47987: Adobe Experience Manager DOM-Based XSS Vulnerability – CVSS 5.4 Analysis

Technical summary

This is a DOM-based XSS vulnerability (CWE-79) in Adobe Experience Manager that arises from improper handling of user-controlled input in the DOM environment. The vulnerability requires a logged-in user (PR:L) to visit a malicious webpage (UI:R), after which attacker-supplied JavaScript executes within the victim's security context. The scope is changed (S:C), meaning the vulnerability can affect resources beyond the vulnerable component itself. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N indicates network accessibility, low attack complexity, and impact limited to confidentiality and integrity—no availability impact.

Business impact

Exploitation could allow attackers to perform actions on behalf of authenticated users, such as modifying content, stealing session tokens, or capturing sensitive information displayed in the user's browser. For organizations running AEM as a content management or digital experience platform, this presents a risk to content integrity and user trust. The requirement for user interaction limits the attack surface, but the scope change means impacts could extend beyond the AEM instance itself if integrations or dependent systems are present.

Affected systems

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected. Organizations using any of these versions should prioritize assessment and patching. Later versions are assumed to contain fixes; verify against Adobe's official security advisory for the exact patched versions available for your deployment track.

Exploitability

Exploitation requires delivery of a crafted webpage to an authenticated AEM user and user interaction (clicking a link or visiting the malicious page). This is not a pre-authentication attack and does not allow direct remote code execution on the server. The attack relies on social engineering or phishing to succeed. While exploitability is not trivial, the low attack complexity and lack of KEV designation suggest no known public exploits are currently circulating, reducing immediate exploit risk.

Remediation

Apply the security patch released by Adobe for your deployed version of Experience Manager. Consult Adobe's official security bulletin to identify the correct patched version for your specific track (6.5.x, LTS SP1, or 2026.x). In the interim, implement content security policy (CSP) headers to restrict script execution and enforce web application firewall rules that block suspicious DOM manipulation patterns. Educate users to avoid clicking unfamiliar links, especially from external sources.

Patch guidance

Check Adobe's official Experience Manager security advisory for the specific patch version applicable to your deployment. The vulnerability affects versions 6.5.24, LTS SP1, 2026.04 and earlier, so upgrades to versions released after these should address the issue. Test patches in a staging environment before production rollout to ensure compatibility with custom components and integrations.

Detection guidance

Monitor web access logs for unusual patterns targeting AEM authoring or publishing endpoints, particularly GET requests with suspicious query parameters or fragments. Look for DOM-based XSS patterns in application logs—repeated attempts to inject script tags or event handlers. Browser-based detection is limited; focus on network and application-level controls. Content Security Policy violation reports can flag blocked inline scripts. If AEM includes audit logging, review for unusual content modifications or session activity from authenticated users.

Why prioritize this

CVSS score of 5.4 (Medium) places this in the standard-priority category. However, prioritization should account for the authentication requirement (reducing risk for public-facing instances) and the lack of known public exploits. Organizations where AEM is externally accessible or receives untrusted traffic should prioritize patching earlier. Those with internal-only deployments can schedule patching within normal quarterly windows.

Risk score, explained

The CVSS 5.4 score reflects the combination of network-accessible attack vector, low attack complexity, and impact on confidentiality and integrity. However, the mandatory authentication requirement (PR:L) and user interaction (UI:R) significantly lower real-world exploitability compared to unauthenticated or automation-friendly attacks. The lack of availability impact and the absence of an active exploit in the wild further mitigate severity. Organizations should treat this as a legitimate but not critical vulnerability requiring timely remediation.

Frequently asked questions