CVE-2026-83958: Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that low-level privileges are required. Exploitation is network-accessible and has low attack complexity.
Does exploitation require action by a victim?
Yes. A victim must visit an attacker-crafted webpage for the malicious JavaScript to execute in the victim's browser context.
What is the expected security impact if exploitation succeeds?
The vulnerability can result in low-impact disclosure and modification of information, with no availability impact indicated. The CVSS vector also indicates a changed scope.