CVE-2026-71356: Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must manipulate the DOM environment and cause a victim to visit a crafted webpage. The victim must interact by visiting that page for malicious JavaScript to execute in the victim's browser context.
Is exploitation possible without an authenticated account?
No. The supplied CVSS vector indicates that low-level privileges are required (PR:L), in addition to network reachability and victim interaction.
What is the likely impact if exploitation succeeds?
The vulnerability can result in limited confidentiality and integrity impact, and its changed scope means the impact can extend beyond the initially vulnerable security authority. No availability impact is indicated.