Adobe Experience Manager: DOM-based Cross-Site Scripting (XSS)
Summary
Adobe Experience Manager (AEM) as a Cloud Service, AEM 6.5 and AEM 6.5 LTS contain a DOM-based Cross-Site Scripting vulnerability. An attacker can manipulate the DOM environment to run malicious JavaScript in the browser of a victim who visits a crafted webpage. Exploitation requires user interaction, low privileges and has a changed scope; the CVSS score is 5.4 (medium) with no availability impact.
Affected
- AEM as a Cloud Service: 0 to 2026.10.29023
- AEM 6.5: 0 to 6.5.25
- AEM 6.5 LTS: 0 to 6.5 LTS SP3
Fixed in
- AEM as a Cloud Service: 2026.10.29251
- AEM 6.5: Cumulative Hotfix (ID disputed: GRANITE-75052 in the Adobe bulletin, GRANITE-75398 in the CVE record; confirm with Adobe)
- AEM 6.5 LTS: Cumulative Hotfix (ID disputed: GRANITE-75052 in the Adobe bulletin, GRANITE-75398 in the CVE record; confirm with Adobe)
Workaround
- Unknown. No vendor workaround identified in the sources.
- Interim measures (analyst suggestions, not from the vendor): restrict access to AEM author and publish interfaces, review custom client-side JavaScript that reads DOM data such as URL fragments or query parameters, and deploy a restrictive Content Security Policy where feasible.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in bulletin APSB26-189.
- Not listed in CISA KEV at the time of research.
- No public proof of concept found; status unknown.
Our recommendation
- Update AEM as a Cloud Service to 2026.10.29251 and apply the cumulative hotfix on self-hosted AEM 6.5 and 6.5 LTS, confirming the hotfix ID with Adobe first.
- Patch the whole APSB26-189 bulletin, not only this CVE.
- Prioritise internet-facing AEM instances in the next maintenance window.
- Check which AEM instances are exposed and monitor for suspicious client-side script activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-189 www.adobe.com
- CVE Record CVE-2026-123258 www.cve.org
- OpenCVE CVE-2026-123258 app.opencve.io
- ZDI November 2026 Security Update Review www.thezdi.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:15.
Original description (NVD)
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.