CVE-2026-47935
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser.
Risk Assessment
Exploitation of this issue may lead to theft of user data or session hijacking. It requires user interaction, which increases the risk if a malicious webpage is visited.
Recommendation
It is recommended to update Adobe Experience Manager to the latest version to mitigate this vulnerability. Additionally, users should be educated on avoiding suspicious websites.
Original NVD description (English source)
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.