Adobe Experience Manager: DOM-based Cross-Site Scripting
Summary
Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker can manipulate the DOM environment so that malicious JavaScript runs in the browser of a victim who opens a crafted web page. The attacker needs a low-privileged account on the target, and the scope is changed. The CVSS base score is 5.4 (Medium), and the vulnerability is addressed in Adobe security bulletin APSB26-189.
Affected
- AEM 6.5: versions 0 to 6.5.25 (per CVE record, CNA Adobe)
- AEM 6.5 with Forms Add-on: affected (vendor bulletin, CVE-specific notes)
- AEM 6.5 LTS with Forms Add-on: affected (vendor bulletin, CVE-specific notes)
- AEM 6.5 LTS without Forms Add-on: not affected (vendor bulletin)
- AEM Cloud Service: affected up to 2026.10.29023 (bulletin; the CNA record does not list it)
Fixed in
- AEM Cloud Service: fixed in 2026.10.29251
- AEM 6.5 with Forms Add-on: AEM Forms 6.5 SP25 Add-on
- AEM 6.5 without Forms Add-on: Forms Hotfix for AEM 6.5 QuickStart - 1.0.12
- AEM 6.5 LTS with Forms Add-on: AEM Forms 6.5 SP25 Add-on
- Note: the CVE record names only the Forms hotfix as unaffected; verify the exact fix for your installed version on the APSB26-189 page.
Workaround
Unknown. Adobe has not published a workaround for this vulnerability.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in APSB26-189.
- OffSeq lists the CVE as not known to be exploited.
- No public proof of concept was found; this is not confirmed absent.
- Not listed in CISA KEV.
Our recommendation
- Identify whether AEM 6.5 or AEM Cloud Service instances exist in your environment, especially internet-facing publish instances.
- Apply the fix from APSB26-189 that matches your installed version and Forms Add-on status. Verify the exact hotfix on the Adobe page first.
- Patch the whole bulletin, not only this CVE, because it also contains Critical items.
- Monitor for unusual browser-side script activity and review user access rights in AEM.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-189 www.adobe.com
- CVE Record CVE-2026-118481 www.cve.org
- OffSeq threat radar CVE-2026-118481 radar.offseq.com
- OpenCVE CVE-2026-118481 app.opencve.io
- ZDI November 2026 security update review www.thezdi.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:23.
Original description (NVD)
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.