Adobe Experience Manager: DOM-based Cross-Site Scripting

Summary

Adobe Experience Manager (AEM) 6.5 and AEM 6.5 LTS contain a DOM-based Cross-Site Scripting (XSS) vulnerability (CVE-2026-118480, CVSS 3.1 5.4, Medium). An attacker can manipulate the DOM environment so that malicious JavaScript runs in the browser of a victim. The victim must first visit a crafted web page, and the attacker needs a low-privilege account. Because the scope is changed, the impact can extend beyond the vulnerable component into the victim's browser session.

Affected

• AEM 6.5: 0 through 6.5.25 (CVE record); Service Pack 25 and earlier (Adobe bulletin APSB26-189)
• AEM 6.5 LTS: Service Pack 3 and earlier (Adobe bulletin APSB26-189)
• AEM Cloud Service: 2026.10.29023 and earlier (Adobe bulletin APSB26-189)

Fixed in

• AEM Cloud Service: 2026.10.29251
• AEM 6.5 Service Packs 23, 24 and 25: Cumulative Hotfix for GRANITE-75052
• AEM 6.5 LTS Service Packs 1, 2 and 3: Cumulative Hotfix for GRANITE-75052
• AEM 6.5 without Forms Add-on: the CVE record names Forms Hotfix for AEM 6.5 QuickStart - 1.0.12, which does not match the GRANITE-75052 hotfix in the bulletin. Verify the correct hotfix on the Adobe page before deployment.
• AEM 6.5 with Forms Add-on: AEM Forms 6.5 SP25 Add-on (per bulletin)

Workaround

Unknown. Adobe has published no vendor workaround for this CVE. Apply the fix.

General hardening (not vendor guidance):

• Restrict access to AEM author and publish instances.
• Deploy a strict Content Security Policy to limit script sources.
• Review custom client-side JavaScript that reads from URL fragments, query strings or document.referrer.

Exploitation

• Adobe states it is not aware of any exploits in the wild for the issues in APSB26-189.
• OpenCVE reports that this CVE is not in the CISA KEV catalogue.
• No public proof of concept found. Status: unknown, not confirmed absent.

Our recommendation

• Patch the complete APSB26-189 update, not this CVE alone, because it bundles several other AEM fixes, including critical ones.
• Prioritise internet-facing AEM 6.5 instances.
• Confirm the exact hotfix ID for your installation on the Adobe bulletin page.
• Check that AEM Cloud Service instances run build 2026.10.29251 or later.
• Restrict access to internal-only AEM instances where possible and monitor for unusual script activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Adobe Security Bulletin APSB26-189 www.adobe.com
• CVE Record CVE-2026-118480 www.cve.org
• OpenCVE CVE-2026-118480 app.opencve.io
• ZDI November 2026 Security Update Review www.thezdi.com
• HKCERT Adobe Monthly Security Update November 2026 www.hkcert.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:23.