Product:
Adobe Experience Manager
Summary
Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim’s browser. Exploitation requires user interaction, as a victim must visit a crafted webpage.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2026-27288 |
Exploitation
To exploit this vulnerability, an attacker must create a malicious webpage that manipulates the DOM environment. When a victim visits this page, the crafted JavaScript executes in their browser, potentially leading to unauthorized actions or data exposure. User interaction is essential for the attack to succeed.
Affected Products
- Adobe Experience Manager 6.5.24 and earlier: Affected by XSS vulnerability requiring user interaction.
- Adobe Experience Manager FP11.7 and earlier: Vulnerable to DOM-based XSS attacks.
Mitigation
To mitigate this vulnerability, users should ensure they are using the latest version of Adobe Experience Manager. Regularly updating software and applying security patches can help protect against known vulnerabilities. Additionally, educating users about the risks of visiting untrusted websites can reduce the likelihood of exploitation.