Product:
Adobe Experience Manager
Summary
Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim’s browser. Exploitation requires user interaction as a victim must visit a specially crafted web page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2026-34623 |
Exploitation
To exploit this vulnerability, an attacker must create a specially crafted web page that, when visited by a user, manipulates the DOM environment. This manipulation allows the attacker to execute malicious JavaScript in the context of the victim’s browser, potentially leading to unauthorized actions or data exposure.
Affected Products
- Adobe Experience Manager 6.5.24 and earlier: Affected by a DOM-based XSS vulnerability requiring user interaction.
- Adobe Experience Manager FP11.7 and earlier: Vulnerable to the same XSS issue as above.
Mitigation
To mitigate this vulnerability, users should ensure they are using the latest version of Adobe Experience Manager. Additionally, implementing security best practices such as input validation and sanitization can help reduce the risk of XSS attacks.