CVE-2026-27288: Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27288?
CVE-2026-27288 has been rated as a critical vulnerability due to its potential for remote code execution through stored Cross-Site Scripting.
How do I fix CVE-2026-27288?
To mitigate CVE-2026-27288, update Adobe Experience Manager to a version later than FP11.7 that includes the necessary security patches.
What versions of Adobe Experience Manager are affected by CVE-2026-27288?
CVE-2026-27288 affects Adobe Experience Manager versions FP11.7 and earlier.
What type of attack can CVE-2026-27288 enable?
CVE-2026-27288 enables stored Cross-Site Scripting attacks that allow attackers to inject malicious scripts into form fields.
Is CVE-2026-27288 a common vulnerability?
CVE-2026-27288 is a notable vulnerability due to the widespread use of Adobe Experience Manager in various organizations.